topic Does splunk support parameterized queries in Splunk Search

Does splunk support parameterized queries

gregbujak — Fri, 17 Dec 2010 01:16:10 GMT

I am curious if parametrized queries are possible within within splunk dashboards or searches:

ex. query: foo=bar AND env=${VARIABLE}

I would then like to be able to define VARIABLE at a higher level or perhaps even have a preamble in the query such as: SET VARIABLE=prod : foo=bar AND env=${VARIABLE}.

This appears to be a similar question: link text

Thanks

Re: Does splunk support parameterized queries

bbingham — Fri, 17 Dec 2010 18:11:28 GMT

Use the form dashboard or the pulldown dashboard, here would be an example:

<form class="formsearch">
       <label>Test Form</label>
       <fieldset>
              <input type="dropdown" token="breakdown" searchWhenChanged="true">
                       <label>Breakdown</label>
                       <choice value="QHour">Quarter Hour</choice>
                       <choice value="Hour">Hour</choice>
              </input>
       </fieldset>

       <row>
              <chart>
                     <searchString>index=main $breakdown$ </searchString>
                     <title>Blah</title>
              </chart>
       </row>
  </form>

So the FieldSet block builds a drop down menu and sets the variable "breakdown" to what ever the user selects, then passes that variable to a chart.

Hope this helps!

Re: Does splunk support parameterized queries

gregbujak — Fri, 17 Dec 2010 23:23:14 GMT

Thanks, that looks like a good place to start.