Dashboards & Visualizations

How to change Splunk query dynamically based on user input from dashboard?

Path Finder

I have a splunk dashboard with dropdown as different client names : A,B,C,ALL.

There will be logs for each client and then I need to search and print the count of selected client from logs, I am able to do that if a user selects A ,B or C, but there is no such client as ALL, if a user selects all, I want to see all logs for A,B,C and sum them and show them in dashboard.

A log look like:



Client Map Details : {A=123, B=245, C=456}



If a user selects A, we show 123 and plot on graph

If a user selects B, we show 245 and plot on graph

If a user selects C, we show 456 and plot on graph

Query for above:


index=temp  sourcetype="xyz" "Client Map Details : " "A"  | rex field=_raw "A=(?<count>\d+)" |  table _time count



But how can I change query based on user input "ALL" and run another splunk query that will see all such lines , and iterate over map and sum each value, 123+456+245 and then give a value to plot?

How do we change slunk query based on user input from dashboard ?

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...