Using tokens in dropdown menu to create two different results

jialiu907 — Mon, 20 Nov 2023 15:07:27 GMT

I am wondering if there's a way to use the dropdown menu and tokens to display two different results. I am trying to have the dropdown menu have static options of "read" and "write".

Read would display this search

index="collectd_test" plugin=disk type=disk_octets plugin_instance=dm-0 | spath output=values0 path=values{0} | spath output=dsnames0 path=dsnames{0} | stats min(values0) as min max(values0) as max avg(values0) as avg by dsnames0 | eval min=round(min, 2) | eval max=round(max, 2) | eval avg=round(avg, 2)

Write would display this search

index="collectd_test" plugin=disk type=disk_octets plugin_instance=dm-0 | spath output=values1 path=values{1} | spath output=dsnames1 path=dsnames{1} | stats min(values1) as min max(values1) as max avg(values1) as avg by dsnames1 | eval min=round(min, 2) | eval max=round(max, 2) | eval avg=round(avg, 2)

The only change in the searches as you can see is just the elements in the multivalue field.

If there is a way to append the search and have it shown together, that would be helpful as well.

Re: Using tokens in dropdown menu to create two different results

ITWhisperer — Mon, 20 Nov 2023 16:09:46 GMT

Set up your dropdown so the value for read is 0 and the value for write is 1 then use the token in the search

index="collectd_test" plugin=disk type=disk_octets plugin_instance=dm-0 | spath output=values$token$ path=values{$token$} | spath output=dsnames$token$ path=dsnames{$token$} | stats min(values$token$) as min max(values$token$) as max avg(values0) as avg by dsnames$token$ | eval min=round(min, 2) | eval max=round(max, 2) | eval avg=round(avg, 2)

topic Re: Using tokens in dropdown menu to create two different results in Splunk Search

Using tokens in dropdown menu to create two different results

Re: Using tokens in dropdown menu to create two different results