topic Re: Different query's based on the result of previous Token in Splunk Search

Different query's based on the result of previous Token

splunk_exercice — Mon, 11 Jun 2018 15:45:00 GMT

Hello,

I have a doubt that I think it´s easy to respond, but until now, I have no results.
I want to make an query that depends on the result of a token, example:

If the token is set to yeallow,
- then the following query will be executed: index=a | stats count by field.name1
If the token is set to red,
- then the following query will be executed: index=b | stats count by field.name2, field.name4
If the toke is set to green,
- then the following query will be executed: index=c | stats count by field.name3, field.name5, field.name6

How can I achieve this?

Thanks in advance.

Best regards.

Re: Different query's based on the result of previous Token

vasanthmss — Mon, 11 Jun 2018 16:15:18 GMT

Hi,

This can be achieve by a simple token you can use refer the below sample.

Description:

Token named "token" can be set to the search based on user selection. With this example i've used the internal index, you may want to try with your index.

Note: This sample will run only you
have access to internal index.

<form>
  <label>Sample</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="token" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="index=_internal | head 10 | stats c by host">host</choice>
      <choice value="index=_internal | head 10 | stats c by sourcetype, host">sourcetype, host</choice>
      <choice value="index=_internal | head 10 | stats c by source, host, sourcetype">source, host, sourcetype</choice>
      <default>index=_internal | head 10 | stats c by host</default>
      <initialValue>index=_internal | head 10 | stats c by host</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$token$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Thanks,
V

Re: Different query's based on the result of previous Token

harishalipaka — Tue, 12 Jun 2018 06:26:44 GMT

<form>
  <label>Sample</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selected" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="field.name1">Yellow</choice>
      <choice value="field.name2, field.name4">red</choice>
      <choice value="field.name3, field.name5, field.name6">green</choice>
      <default>Yellow</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>|stats count by $selected$</title>
      <single>
        <search>
          <query>|makeresults |eval tokenvalue="$selected$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>