My input tag looks like this     </input> <input type="multiselect" token="fruit_name"> <label>Fruit name</label> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>fruit_name</fieldForLabel> <fieldForValue>fruit_name</fieldForValue> <search> <query>index=splunk query | mvexpand fruit_name </query> </search> <delimiter> </delimiter> <change> <eval token="fruit"> <expression>if(isnull($fruit_name$), "//*", $fruit_name$)</expression> <default>*</default> </eval> </change> </input>     I use `fruit` later in a panel in the XML dashboard. The issue is if user doesn’t select anything from the drop down, `fruit_name` still holds value '*' but the panel which uses `fruit` just shows a message `Search is waiting for input...`. How can I make sure that when user doesn’t select anything, along with `fruit_name` `fruit` also holds the default value which is '*'. Please help. ... View more

Consider I have 8 events. 1. txn started for fruit.mango 2. money paid for fruit.mango 3. received fruit.mango 4. txn completed for fruit.mango 5. cust wants to buy apple 6. getting money for apple 7. sending apple to cust 8. txn started for veegtable.carrot I get a variable 'name' from my dashboard. This name is actually a string consisting of space separated words or just a single word. For ex. it could be either 'apple' or 'txn started for fruit.mango'.  What I want to do is first I want to extract the name of article then search the whole event space with that article name and then do further processing. Ex. If I get $name$= 'txn started for fruit.mango'. I want to extract mango and then run the query such that I get all the events which have the word mango in it. After that i create a table of the steps the transaction took. I use      index=.. $name | if(match($name, "\s"), mvindex(split($name, "."), 1), $name)     to extract the name but  then I get only a single event matching that is `txn started for fruit.mango`, other events which also has 'mango' in it like 'received fruit.mango' doesnt match. How do I go about it? Any help will be much appreciated, thanks. ... View more