Hello.
I have these two rows (PR_Tags and PR_ID). Need to return the PR_ID's that are matching the PR_Tags when I select in a Dropdown filter (Like if I select the line 1row 1, return the PR_ID's that matches this PR_Tag selected)
How can I do that?
index= host= sourcetype=csv source=........\\resul_test.csv
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
maybe this wil help?:
<form version="1.1">
<label>tmp-pr-tags</label>
<fieldset>
<input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
<label>Selecteer een PR_Tag:</label>
<choice value="*">PR_Tags...</choice>
<search>
<query>
<![CDATA[
index=main sourcetype=csv source=result_test.csv
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
]]>
</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldForLabel>PR_Tags</fieldForLabel>
<fieldForValue>PR_Tags</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<title>PR_Tags</title>
<table>
<search>
<query>
index=main sourcetype=csv source=result_test.csv
| where PR_Tags="$dropdown_tok$"
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
</query>
</search>
<option name="count">50</option>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
maybe this wil help?:
<form version="1.1">
<label>tmp-pr-tags</label>
<fieldset>
<input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
<label>Selecteer een PR_Tag:</label>
<choice value="*">PR_Tags...</choice>
<search>
<query>
<![CDATA[
index=main sourcetype=csv source=result_test.csv
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
]]>
</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldForLabel>PR_Tags</fieldForLabel>
<fieldForValue>PR_Tags</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<title>PR_Tags</title>
<table>
<search>
<query>
index=main sourcetype=csv source=result_test.csv
| where PR_Tags="$dropdown_tok$"
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID
</query>
</search>
<option name="count">50</option>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>