topic Can a variable value which depends on a dropdown token be included in search? in Splunk Search

Can a variable value which depends on a dropdown token be included in search?

efranke — Thu, 12 Sep 2019 14:28:07 GMT

Hello everyone,

I am trying to assign a value to "myVar", which depends on a dropdown token on my dashboard. The value of "myVar" is used to search for a specific sourcetype. This is my current solution which does not work:

index="dev_analytics" OR index="live_analytics" | 
eval myVar=case($instance$==servertoserver-test,"flink_dev2",$instance$==servertoserver-prod,"s2sdatacollector") | 
where sourcetype==myVar

It works, if I just assign the specific value to "myVar" (eval myVar=="mySourcetype"). For specifc reasons, I can not do something like sourcetype=$instance$.

Is there anything I can do to make my solution work?

Thanks in advance and regards,
Eric

Re: Can a variable value which depends on a dropdown token be included in search?

renjith_nair — Fri, 13 Sep 2019 03:45:33 GMT

@efranke ,

Set the value at the dropdown on change event.

Here is an example

<form>
  <label>efranke</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="instance">
      <label>Instance</label>
      <choice value="servertoserver-test">servertoserver-test</choice>
      <choice value="servertoserver-prod">servertoserver-prod</choice>
      <default>servertoserver-test</default>
      <initialValue>servertoserver-test</initialValue>
      <change>
        <condition value="servertoserver-test">
          <set token="sourcetype">flink_dev2</set>
        </condition>
        <condition value="servertoserver-prod">
          <set token="sourcetype">s2sdatacollector</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Result for $sourcetype$</title>
      <table>
        <search>
          <query>index="dev_analytics" OR index="live_analytics" sourcetype="$sourcetype$"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Re: Can a variable value which depends on a dropdown token be included in search?

efranke — Fri, 13 Sep 2019 05:56:10 GMT

@renjith.nair

Thank you, the solution works perfectly for me.

Regards,
Eric