Dashboards & Visualizations

Dashboard that takes one input(field) and then determines which query to run?

Patrunner
Engager

Anyone have a tip on how to have a token(from field)- and then determine which query to run based on that input? 

For example
(datasources/queries: fruit, meat, vegetable)

Field: banana
->run query for fruit
->display table about banana from said query. 

Struggling with this one- trying to make a dynamic search bar that populates tables based on the input- thus making multiple of my dashboard redundant. Slimming things down. 

Labels (1)
0 Karma

Patrunner
Engager

Thanks for the reply, however Im not quite looking for an alternative solution. Im wondering if this is something splunk is capable of. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Another option perhaps closer to what you seek is to have each input set a token with the appropriate query string.  Then the search will just invoke that token.

For instance, if "banana" is selected, then the input token's <change> element might set a token called $query$ to what is needed to search for fruit.  The <query> element then becomes simply

<query>$query$</query>

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One approach is to have a separate panel for each search then have the selected token make the appropriate panel appear. 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...