topic Re: Search based on two different dropdowns in Splunk Search

Search based on two different dropdowns

martin61 — Wed, 05 Jan 2022 22:08:36 GMT

I have two dropdowns. I only want to run a single dropdown everytime for a search.

Closed Dropdown has token value as field1

OPEN Dropdown has token value as field4

In the dashboard's source, I have listed below query, so that the panel picks up the data as per input provided in dropdowm

index=*|lookup bar.csv IP OUTPUT BAR BAR_Status |search BAR="$field1$" OR BAR="$field4$"|chart count(IP) by BAR,STATUS

So If select closed dropdown the chart should provide the details only related to Closed and vice-versa. Please help.

Re: Search based on two different dropdowns

yuanliu — Thu, 06 Jan 2022 06:58:28 GMT

Reads like what you need is "AND" not "OR". You want to give each dropdown token a default value of "*", then use

index=*|lookup bar.csv IP OUTPUT BAR BAR_Status |search BAR="$field1$" AND BAR="$field4$"|chart count(IP) by BAR,STATUS

This way, the unselected dropdown will always result in a true condition. (You may also want to see if there is a different workflow for the dashboard to avoid two dropdowns for the same field. Additionally, you want to give input tokens descriptive names.)