topic Re: Passing tokens dynamically to search query in Splunk Search

Passing tokens dynamically to search query

k_harini — Tue, 18 Oct 2016 07:32:00 GMT

I have a drop down which I populate with the query and editing field values
index="myindex"|stats values(Category) as categories|rex field=categories mode=sed "s/Change Request/CR/" |rex field=categories mode=sed "s/Central Functions/CF/"| mvexpand categories|eval label= categories |eval value = categories

Now since I had changed drop down values how will i pass the original field value as token to my search query where it will work
index="myindex" Category=$categories$| chart count over sourcetype by "Priority" | addtotals fieldname=Total| foreach * [eval Req_Percent = count *100 / Total] | fields - Total

This is not working.. I want to pass the category i select from drop down and change it to field value and pass to query.. How can i accomplish that.. Please help

Re: Passing tokens dynamically to search query

gcusello — Tue, 18 Oct 2016 07:39:26 GMT

if you open the search dashboard from your panel, what you find instead of $categories$?
Bye.
Giuseppe

Re: Passing tokens dynamically to search query

k_harini — Tue, 18 Oct 2016 08:40:08 GMT

I get no results found.. When i give query with full field values, its displaying correctly

Re: Passing tokens dynamically to search query

gcusello — Tue, 18 Oct 2016 09:14:24 GMT

Open your search in the search dashboard, you should have something like this:

index="myindex" Category=$categories$|...

index="myindex" Category=Category=$categories$| ...

or something else, in other words: what you have after Category=?.

Every way make another try, if some values of category are strings with spaces:
index="myindex" Category="$categories$"| ...
put double quotes around token.

Bye.
Giuseppe

Re: Passing tokens dynamically to search query

k_harini — Tue, 18 Oct 2016 11:09:13 GMT

I added double quotes. Reason its not displaying is.. I have used rex in dropdown query and modified the values in drop down (reduced field values length).. when i pass those values to search, they are not there in my log and not getting displayed. Problem here is I'm not able to add rex as calculated field in props file.. Any idea on how to add this as calculated field? Thanks!

Re: Passing tokens dynamically to search query

sundareshr — Tue, 18 Oct 2016 11:18:14 GMT

Try this

index="myindex" | rex field=categories mode=sed "s/Change Request/CR/" | rex field=categories mode=sed "s/Central Functions/CF/"| mvexpand categories |  search Category="$categories$" | chart count over sourcetype by "Priority" | addtotals fieldname=Total| foreach * [eval Req_Percent = count *100 / Total] | fields - Total

Re: Passing tokens dynamically to search query

nagarjuna560 — Mon, 25 Nov 2019 06:40:53 GMT

Harini,
did you find a solution to this issue?