Dashboards & Visualizations

Dashboard that takes one input(field) and then determines which query to run?

Patrunner
Engager

Anyone have a tip on how to have a token(from field)- and then determine which query to run based on that input? 

For example
(datasources/queries: fruit, meat, vegetable)

Field: banana
->run query for fruit
->display table about banana from said query. 

Struggling with this one- trying to make a dynamic search bar that populates tables based on the input- thus making multiple of my dashboard redundant. Slimming things down. 

Labels (1)
0 Karma

Patrunner
Engager

Thanks for the reply, however Im not quite looking for an alternative solution. Im wondering if this is something splunk is capable of. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Another option perhaps closer to what you seek is to have each input set a token with the appropriate query string.  Then the search will just invoke that token.

For instance, if "banana" is selected, then the input token's <change> element might set a token called $query$ to what is needed to search for fruit.  The <query> element then becomes simply

<query>$query$</query>

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One approach is to have a separate panel for each search then have the selected token make the appropriate panel appear. 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...