topic Re: Filter based on token from macro in Splunk Search

Filter based on token from macro

smanojkumar — Wed, 03 Jan 2024 11:04:19 GMT

Hi Splunkers!

I would like to filter in a field when I received a specific value from multiselect input dropdown,

I'm having a field "Type" where I will get multiselect values, that will be passed to a search by macro, in that search, i would like to filter "Assetname" with field of having Z in 3rd letter, only when I'm getting ADZ value from the field "Type"

When I'm not getting the value ADZ, i need to get all values in the field Assetname

Type - Indus, ADZ, Stan
Assetname - abZahd-2839

so, the Assetname with 3rd letter Z needs to be filtered.

Thanks in Advance!

Manoj Kumar S

Re: Filter based on token from macro

dtburrows3 — Wed, 03 Jan 2024 15:54:57 GMT

I think you could put in a change tag in the multiselect to evaluate a new token to use as a conditional filter based on the selection of the multiselect.

<input type="multiselect" token="Type" searchWhenChanged="true"> <choice value="ADZ">ADZ</choice> ... <change> <eval token="assetname_filter">if(match('Type', "ADZ"), "match(Assetname, \"^\\S{2}Z\")", "isnotnull(Assetname)")</eval> </change> ... </input>

And then in the search you are wanting to filter you can use the $assetname_filter$ token after a where command like this

<base_search> | where $assetname_filter$

Examples of functionality:
No ADZ selected (All assets showing)

ADZ one of the values selected in the multiselect (Only **Z* Assetname are in final output)

Re: Filter based on token from macro

smanojkumar — Thu, 04 Jan 2024 12:18:14 GMT

Hi @dtburrows3 ,

Thanks for your response!

If we need to add those two lined in a single search of macro, where we are receiving Type as a token from Search/dashboard, How to do that?

I tried this way, It dosen't work

| where if(macth('Type', "ADZ"), "match(Assetname, \"^\\S{2}Z\")", "isnotnull(Assetname)")

Thanks in Advance!

Re: Filter based on token from macro

dtburrows3 — Thu, 04 Jan 2024 16:55:25 GMT

the where command is expecting some sort of boolean result after the logic statement is evaluated. The if() function you shared is passing just another logic statement. I think to do it in a where command would look something like this.

| where if(((match('Type', "ADZ") AND match('Assetname', "^\S{2}Z")) OR NOT match('Type', "ADZ")), True(), False())

Note: This method is expecting the field Type and Assetname to both be available fields in the dataset up to the point of it's execution. So a simple example of making the "Type" field available from the multiselect would be

<base_search> ``` make the multiselect token value an available field in the dataset ``` ``` Since it is common for multiselect token values to be formatted with double-quotes, doing a $<token_name>|s$ here should account for that ``` ``` It is assumed that the field "Assetname" is available and derived from <base_search> above. ``` | eval Type=$Type|s$ | where if(((match('Type', "ADZ") AND match('Assetname', "^\S{2}Z")) OR NOT match('Type', "ADZ")), True(), False())

Examples: (with ADZ in Type token)

(without ADZ in Type token)