How to modify a part of a search based on two inputs selection?

ktn01 — Tue, 09 Apr 2019 15:05:53 GMT

Hello,
I have a dashboard with 2 inputs:

A radio input with two buttons, index and role, with the token view
Text input with the token filter

And a table with the result of a search.

I want to set the end off my search depending the values of $view$ and $filter$

I should have " | search index_name=*$filter$* | stats values(Role) by index_name " if $view$ is index
or " | search Role=*$filter$* | stats values(index_name) by Role " if $view$ is role

Any idee how to do this?

Thanks

Re: How to modify a part of a search based on two inputs selection?

somesoni2 — Tue, 09 Apr 2019 15:11:57 GMT

You can set new tokens( which will be used in search) based on the value selected in the radio button. See the example in following Splunk documentation:
https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/PanelreferenceforSimplifiedXML#condition_.28form_input.29

topic Re: How to modify a part of a search based on two inputs selection? in Splunk Search

How to modify a part of a search based on two inputs selection?

Re: How to modify a part of a search based on two inputs selection?