topic Re: Based on user input, add conditionals to both base-query and regular query of a dashboard in Splunk Search

Based on user input, how to add conditionals to both base-query and regular query of a dashboard?

sthaker — Mon, 21 Aug 2023 19:44:53 GMT

Splunk dashboard: We have a dropdown with 2 possible values, option1 and option2.
Based on what user selects, (
option1: "A" or "B" ) gets added to both base-query and query OR
option2: ("X" or "Y") gets added to both base-query and query.

1. If user selects "option1", query is

<query>index=logs sourcetype=ci "Shipping Finished" ("A" OR "B") ...</query>

<query> | join some_field [ search index=logs sourcetype=ci | search ("A" OR "B") AND "Received complete status"

2. If user selects "option2", query is:

<query>index=logs sourcetype=ci "Shipping Finished" ("X" OR "Y") ... </query>

<query> | join some_field [ search index=logs sourcetype=ci | search ("X" OR "Y") AND "Received complete status"

Re: Based on user input, add conditionals to both base-query and regular query of a dashboard

ITWhisperer — Sat, 19 Aug 2023 08:02:56 GMT

Your dropdown sets a token to a string. This string is substituted into your searches whenever it is mentioned.

<search id="base_query"> <query>index=logs sourcetype=ci "Shipping Finished" $token$ ...</query> <search base="base_query"> <query> | join some_field [ search index=logs sourcetype=ci | search $token$ AND "Received complete status"

Re: Based on user input, add conditionals to both base-query and regular query of a dashboard

sthaker — Sat, 19 Aug 2023 14:30:51 GMT

Thanks ITWhisperer. This works. In the past I was adding () around my search strings due to which it didn't work.

Here's the correct way to define input dropdown, I added values as follows:

<input type="dropdown" token="ip_family" searchWhenChanged="true">
<label>IP Family</label>
<choice value=""Foo" OR "Bar"">option1</choice>

<choice value=""Boo" OR "Baz"">option2</choice>