Dashboards & Visualizations

How to change Splunk query dynamically based on user input from dashboard?

user9025
Path Finder

I have a splunk dashboard with dropdown as different client names : A,B,C,ALL.

There will be logs for each client and then I need to search and print the count of selected client from logs, I am able to do that if a user selects A ,B or C, but there is no such client as ALL, if a user selects all, I want to see all logs for A,B,C and sum them and show them in dashboard.

A log look like:

 

 

Client Map Details : {A=123, B=245, C=456}

 

 

If a user selects A, we show 123 and plot on graph

If a user selects B, we show 245 and plot on graph

If a user selects C, we show 456 and plot on graph

Query for above:

 

index=temp  sourcetype="xyz" "Client Map Details : " "A"  | rex field=_raw "A=(?<count>\d+)" |  table _time count

 

 

But how can I change query based on user input "ALL" and run another splunk query that will see all such lines , and iterate over map and sum each value, 123+456+245 and then give a value to plot?

How do we change slunk query based on user input from dashboard ?

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...