topic Re: Can you change the base search depending on a drop down value? in Splunk Search

Can you change the base search depending on a drop down value?

replicant — Mon, 07 Nov 2022 14:50:30 GMT

I have a dashboard that uses a dbxquery in the base search. I would like to make the dashboard "bilingual".

Is it possible to alter the behavior of the dashboard and select a different base search depending on the value of a drop down or radio button?

For example, selecting the first of the two options should have this base search be used:

<search id="base1">
<query>| dbxquery shortnames=true output=csv connection="CON_1" query="use [DB1] select TimeRaised as 'TimeTriggered', ...</query>

...while selecting the 2nd of the two options would use this one:

<search id="base1">
<query>| dbxquery shortnames=true output=csv connection="CON_2" query="use [DB2] select TimeRaised as 'TimeTriggered', ...</query>

Re: Can you change the base search depending on a drop down value?

richgalloway — Mon, 07 Nov 2022 15:24:46 GMT

Rather than change the base search, consider changing parameters of the search. If this is the base search

<query>| dbxquery shortnames=true output=csv connection=$CON|S$ query="use [$DB$] select TimeRaised as 'TimeTriggered', ...</query>

then you just need the dropdown selector to set the $CON$ and $DB$ tokens to the appropriate values.

Re: Can you change the base search depending on a drop down value?

replicant — Tue, 08 Nov 2022 12:42:39 GMT

@richgalloway - Perfect. Karma given. Thanks.

Re: Can you change the base search depending on a drop down value?

richgalloway — Tue, 08 Nov 2022 13:21:25 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.