Hey guys
So I would like to have a search select events from myindex based on what the user selects in a multiselect.
One way that I can think to do this is to do:
index=myindex ("some raw string that option1 represents ending in a space " AND match($multiselect$,"option1")) OR ("some raw string that option2 represents not ending in a space" AND match($multiselect$,"option2")) OR ("some raw string that option3 represents ending in a space " AND match($multiselect$,"option3"))
However this option does not work. You cannot do a match in the initial search execution, as far as I can tell. Is this correct?
I tried just index=myindex AND match("asdf","asdf") | head 1
and that doesn't work. I could eval temp="$multiselect$"
and then match(temp,"option1")
however that is not an elegant solution. I want to search for the strings during the initial search because that time complexity is exponentially better. Also I can't use valuePrefix/delimiter because the searched strings end in a white space per https://answers.splunk.com/answers/750199/how-can-i-include-a-trailing-whitespace-in-a-multi.html
Thoughts?
if i add the space in the simple xml, it seems to honor it? See the valueSuffix below. When i went back to the gui, it kept the space.
<input type="multiselect" token="field1">
<label>field1</label>
<choice value="some raw text option1">option 1</choice>
<choice value="some raw text option 2">option2</choice>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix> "</valueSuffix>
<delimiter> OR </delimiter>
</input>
but not every value ends in a space. so I can't just add the suffix for all.
ah...rtfm...got it.
rtfm? there is zero in documentation about either question
oh sorry, that was a reference to me not reading your question closely ("read the f'ing manual").
how about including the quotes in the values instead of the prefix suffix?
<input type="multiselect" token="field1">
<label>field1</label>
<choice value=""some raw text option "">option 1</choice>
<choice value=""some raw text option"">option2</choice>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix></valuePrefix>
<valueSuffix></valueSuffix>
<delimiter> OR </delimiter>
</input>
Still dumps the white space.
o cool. will try tomorrow AM thx!!