How to change Splunk query dynamically based on user input from dashboard?

user9025 — Thu, 15 Dec 2022 14:16:30 GMT

I have a splunk dashboard with dropdown as different client names : A,B,C,ALL.

There will be logs for each client and then I need to search and print the count of selected client from logs, I am able to do that if a user selects A ,B or C, but there is no such client as ALL, if a user selects all, I want to see all logs for A,B,C and sum them and show them in dashboard.

A log look like:

Client Map Details : {A=123, B=245, C=456}

If a user selects A, we show 123 and plot on graph

If a user selects B, we show 245 and plot on graph

If a user selects C, we show 456 and plot on graph

Query for above:

index=temp sourcetype="xyz" "Client Map Details : " "A" | rex field=_raw "A=(?<count>\d+)" | table _time count

But how can I change query based on user input "ALL" and run another splunk query that will see all such lines , and iterate over map and sum each value, 123+456+245 and then give a value to plot?

How do we change slunk query based on user input from dashboard ?

topic How to change Splunk query dynamically based on user input from dashboard? in Dashboards & Visualizations

How to change Splunk query dynamically based on user input from dashboard?