<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Using OR in a pivot query in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Using-OR-in-a-pivot-query/m-p/396170#M6714</link>
    <description>&lt;P&gt;I have a data set with following query and it is saved as "model_requests"&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;(service=service* OR (service=Aservice* AND app_name=app*)) some_other_fields=*
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Under my dash boards I have a single value chart with following query:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| pivot model_requests RootObject count(RootObject) AS "Count of Requests" FILTER service in $service_token$
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;$service_token$ points to a drop down in the dashboard, which has different service names or * which is a list of a set of services.&lt;BR /&gt;
Example drop down options under static options: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Name         Value
*            (Service1, Service2)
Service1     Service1
Service2     Service2
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I have added a new drop down for app_name and its token name is $app_token$ as follows: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Name     Value
*        (app1, app2)
app1     app1
app2     app2
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;In the pivot query, I am looking to have an OR in it to choose between the tokens service_token and app_token (Either or, both tokens data will not exists at the same time). &lt;BR /&gt;
For example as follows: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| pivot model_requests RootObject count(RootObject) AS "Count of Requests" (FILTER service in $service_token$ OR FILTER app_name in $app_token$) FILTER something_else=*
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This query doesn't work. Is there a way around this? Thanks. &lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 20:49:17 GMT</pubDate>
    <dc:creator>angersleek</dc:creator>
    <dc:date>2020-09-29T20:49:17Z</dc:date>
    <item>
      <title>Using OR in a pivot query</title>
      <link>https://community.splunk.com/t5/Reporting/Using-OR-in-a-pivot-query/m-p/396170#M6714</link>
      <description>&lt;P&gt;I have a data set with following query and it is saved as "model_requests"&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;(service=service* OR (service=Aservice* AND app_name=app*)) some_other_fields=*
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Under my dash boards I have a single value chart with following query:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| pivot model_requests RootObject count(RootObject) AS "Count of Requests" FILTER service in $service_token$
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;$service_token$ points to a drop down in the dashboard, which has different service names or * which is a list of a set of services.&lt;BR /&gt;
Example drop down options under static options: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Name         Value
*            (Service1, Service2)
Service1     Service1
Service2     Service2
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I have added a new drop down for app_name and its token name is $app_token$ as follows: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Name     Value
*        (app1, app2)
app1     app1
app2     app2
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;In the pivot query, I am looking to have an OR in it to choose between the tokens service_token and app_token (Either or, both tokens data will not exists at the same time). &lt;BR /&gt;
For example as follows: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| pivot model_requests RootObject count(RootObject) AS "Count of Requests" (FILTER service in $service_token$ OR FILTER app_name in $app_token$) FILTER something_else=*
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;This query doesn't work. Is there a way around this? Thanks. &lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 20:49:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Using-OR-in-a-pivot-query/m-p/396170#M6714</guid>
      <dc:creator>angersleek</dc:creator>
      <dc:date>2020-09-29T20:49:17Z</dc:date>
    </item>
  </channel>
</rss>

