Thank you for your reply. I can try to sanitize a data set, but they are sensitive log files so it would be rather difficult. Yes, it is a dashboard and I am passing a token (the token is called "key") from a text entry box.
I believe I now have the multivalue text input search working like this:
index=<index> sourcetype=<sourcetype> url IN ($key$)
and
index=<index> sourcetype=<sourcetype> [stats count | eval url = "$key$" | makemv url delim=" " | mvexpand url | fields url] | table url, host
I prefer the second way as I can use space as the delimiter. I believe the reason it wasn't working before was because of the formatting of the input.
I am still unable to add in *'s at the beginning and end of each entry automatically.
Ex.
textfield: google.com,msn.com,bing.com
but have the search look for *google.com*, *msn.com*, or *bing.com*.
Is there a way that add the wildcards in before searching?
I apologize for not having figured out my first issue earlier, a blatant oversight on my part.
... View more