topic Re: Search query to retrive host upon selection in Splunk Search

Search query to retrive host upon selection

imthesplunker — Sun, 29 Jan 2017 22:17:40 GMT

Hi,

I have 2 versions with multiple hosts containing dev and stg environment
version1 is 7.2 with host1, host2,... host10(5 dev & 5 stg hosts)
version2 is 8.1 with host1, host2,....host10(3 dev & 7 stg hosts)

I have created dropdown for version(11.2,12.1) and multiselect for enviornment(dev,stg) .
What will be the search query to retrieve host based on selection (for ex :- version1 and stg env )

Re: Search query to retrive host upon selection

gokadroid — Mon, 30 Jan 2017 06:44:44 GMT

If you are able to search events like index=yourIndex sourcetype=yourScourcetype "11.2" (host=host1 OR host=host2) to return all events of version 11.2 for hosts host1 or host2 then follow the below approach and ensure you have following points covered:

Take a note of the token for your dropdown, I will call it tok_dropdown_version
Take a note of the token for your multiselect, I will call it myToken
Take a note of this answer on multiselect which tells you how to form a query of type (field1=value1 OR field1=value2) which in your case will be host=host1 OR host=host2 and so on (however many values will be selected from multiselect).

With these three as arsenal then your final query shall be like

index=yourIndex sourcetype=yourSourcetype $tok_dropdown_version$ ($myToken$)

Re: Search query to retrive host upon selection

imthesplunker — Mon, 30 Jan 2017 19:28:28 GMT

This helped me .thanks