topic Re: dropdown value used in different ways in Splunk Search

How to use dropdown value in different ways?

thenormalone — Wed, 21 Sep 2022 23:20:30 GMT

I have a dropdown whose value once input needs to be used in two different ways in the same search query. One of the indexes require that value to be as is but the other index requires the value to be altered.

I'm doing something like what ive mentioned below but that doesn't seem to be working. Any help is appreciated.

dropdown token value is selected_client with the initial value being "*" (index = indexA OR index = indexB) AND (clientForIndexA = domain1 OR clientForIndexB = domain2) | eval domain1 = if("$selected_client$" == "*", "*", "$selected_client$") | eval domain2 = if(domain1 == "*", "*", replace (sync_ml_domain, "\." , "-")) | eval domain2 = if(domain1 == "*", "*", replace (sync_ml_domain, "_" , "-"))

Re: dropdown value used in different ways

jdunlea — Wed, 21 Sep 2022 21:52:18 GMT

I presume you are trying to replace both the "." and the "_" with a "-" for domain2?

If so, the issue was with the two eval statements for domain2. I was able to make it work (at least for what I think you are trying to achieve) as follows:

| eval domain1 = "$selected_client$" | eval domain2 = if(domain1 == "*", "*", replace (sync_ml_domain, "[\.|_]" , "-"))

Also, you will notice that I do not have an IF statement for domain 1, as it appears to be redundant the way it was written. Let me know if this solves your problem!

Re: dropdown value used in different ways

thenormalone — Thu, 22 Sep 2022 12:51:35 GMT

I am trying to replace both the "." and the "_" with a "-" for domain2, thanks for the suggestion.

So the default value for $selected_client$ is * which it is being assigned to domain 1 however search doesn't return anything because clientForIndexA still just maps to domain1 in my dashboard panel

(clientForIndexA = domain1 OR clientForIndexB = host*domain2*prod) | eval domain1 = "*" | eval domain2 = if(domain1 == "*", "*", replace (domain1, "[\.|_]" , "-"))

so how do I get the values of domain1 and domain2 to be used in the search query?

Re: dropdown value used in different ways

bowesmana — Thu, 22 Sep 2022 07:09:06 GMT

If I understand correctly, you are trying to match the clientForIndex?? against the selected dropdown where the field has a different format in each index and want to do something like this?

(index = indexA clientForIndexA = $selected_client$) OR (index = indexB clientForIndexB = $modified_client$)

where selected_client is the chosen value to match against clientForIndexA field from the dropdown and clientForIndexB needs to match against a modified domain format.

In that case, just create a second token in a change block of the input, like this

<input type="dropdown" token="selected_client"> ... <change> <eval token="modified_client">replace($value$, "[\.|_]", "-")</eval> <change> </input>

however, I am not sure if I understood your question correctly as you have the sync_ml_domain field

Anyway, you can't do eval statements after the search which can then change the effect of the search like you are doing.

Re: dropdown value used in different ways

thenormalone — Thu, 22 Sep 2022 15:01:58 GMT

Thanks for the suggestion! I was able to get it to run successfully using

<change> <eval token="modified_client">replace($value$, "[.|_]", "-")</eval> <change>