topic Re: Search parameter changed, need help with query in Splunk Search

Search parameter changed, need help with query

jiaqya — Thu, 26 Mar 2020 09:26:11 GMT

i have a search parameter for ex : search Data="Test". This data is there in the index and it has daily ingest and it has daily _time.

This Data field is a filter , which i select and then it shows me all the data with Data="Test" via drilldown token.
Now this field has changed to "NoTest"

now when i choose from drilldown, i see "NoTest" instead of "Test".
if i choose "NoTest", all previous data is not showing as they all have Data="Test": ( this table has historical data so i need to show both )

i need a way to show both "NoTest" and "Test" without changing much of query ( as other filters are unchanged, only this one has changed )

Re: Search parameter changed, need help with query

to4kawa — Sun, 29 Mar 2020 21:37:28 GMT

use base search
see

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/Savedsearches

https://answers.splunk.com/answers/239159/multiple-base-searches-in-a-dasboard-with-post-pro.html

Re: Search parameter changed, need help with query

_gkollias — Mon, 30 Mar 2020 00:49:47 GMT

I assume you're working with dashboards here? Without seeing the source code, it's hard to say what the root cause is. Can you provide the Simple XML and a dummy of the example search that you're using?

These docs may be helpful in your case:

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/tokens
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/FormEditor

Also, I recommend downloading the Dashboard Examples app from Splunkbase where you can copy example source code for dropdown inputs (and more!):

https://splunkbase.splunk.com/app/1603/

Re: Search parameter changed, need help with query

woodcock — Mon, 30 Mar 2020 02:53:08 GMT

Show us your XML.

Re: Search parameter changed, need help with query

jiaqya — Tue, 31 Mar 2020 06:06:45 GMT

i will not be able to share the query , but i found a way around it, i was able to eval and replace the old value with new value so that it works fine now, its a bit slow , but does the job...