Dashboards & Visualizations

How can I vary the search template based on a token value in a form?

tmccarty
Explorer

I have a form on which I'd like to run different search templates depending on the user input. For this particular problem, I'm working with DB Connect pulling data from summary tables, but we may have similar needs with log data running through Splunk in a more traditional manner as well.

Ex 1: Radio button input so the user can specify whether to present the results in summary, monthly, or weekly breakdowns. In this case, the search pulls from different pre-summarized tables depending upon the level of granularity applied.

Ex 2: Optional text field that if the user enters a value, an extra filter is applied to the search with the value of the field. If blank, the filter is not applied.

Is there any way to select which search template to run based on the value of a token?

We're currently running Splunk 6.0 and planning to upgrade to 6.1 shortly.

Thanks for any ideas you can offer.

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

It looks like based on choices made in #1 and #2, you compute a new search string.

If you bind the radio button in #1 to $timePeriod$, the text field in #2 to $extraFilter$, and the search template to $computedSearch$, you could create a JS TokenForwarder that recomputes $computedSearch$ whenever #1 and #2 change.

For example:

require([
    "splunkjs/ready!",
    "splunkjs/mvc/tokenforwarder"
], function(mvc, TokenForwarder) {
    new TokenForwarder(
        ["$timePeriod$", "$extraFilter"],
        "$computedSearch$",
        function(timePeriod, extraFilter) {
            var computedSearch;
            if (timePeriod === 'summary') {
                computedSearch = ...
            } else if (timePeriod === 'monthly') {
                computedSearch = ...
            } else if (timePeriod === 'weekly') {
                computedSearch = ...
            }

            if (extraFilter !== '') {
                computedSearch += ' | search ' + extraFilter;
            }

            return computedSearch;
        }
    );
});

More details on transforming and validating tokens here:
http://dev.splunk.com/view/SP-CAAAEW4

tmccarty
Explorer

This sounds like exactly what I need. I'll check it out - thanks!

0 Karma

dwaddle
SplunkTrust
SplunkTrust

I think both of your examples are pretty easy using Sideview Utils. Your example #2 there is a classic case of SVU's template= parameter that lets you completely omit form search fields from the dispatched search if the form search data entry field is empty. Check out the newest release of Sideview Utils (with extensive examples) at http://sideviewapps.com/apps/sideview-utils/

0 Karma

tmccarty
Explorer

Thanks for the tip - I've installed Sideview Utils and am looking at it now.

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...