Dashboards & Visualizations

How to join rows to compare values?

KalebeRS
Explorer

Hello.

I have these two rows (PR_Tags and PR_ID). Need to return the PR_ID's that are matching the PR_Tags when I select in a Dropdown filter (Like if I select the line 1row 1, return the PR_ID's that matches this PR_Tag selected)

KalebeRS_0-1686635236994.png

How can I do that?

 

index= host=  sourcetype=csv source=........\\resul_test.csv 
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID

 

Labels (1)
0 Karma
1 Solution

rrovers
Contributor

maybe this wil help?:

<form version="1.1">
  <label>tmp-pr-tags</label>
  <fieldset>
      <input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
      <label>Selecteer een PR_Tag:</label>
      <choice value="*">PR_Tags...</choice>
      <search>
        <query>
          <![CDATA[
           index=main sourcetype=csv source=result_test.csv 
           | table PR_Tags, PR_ID
           | eval PR_Tags=split(PR_Tags,",")
           | mvexpand PR_Tags
           | dedup PR_Tags PR_ID
          ]]>
        </query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <fieldForLabel>PR_Tags</fieldForLabel>
      <fieldForValue>PR_Tags</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>PR_Tags</title>
      <table>
        <search>
          <query>
           index=main sourcetype=csv source=result_test.csv 
           | where PR_Tags="$dropdown_tok$"
           | table PR_Tags, PR_ID
           | eval PR_Tags=split(PR_Tags,",")
           | mvexpand PR_Tags
           | dedup PR_Tags PR_ID
          </query>
        </search>
        <option name="count">50</option>
        <option name="drilldown">none</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

rrovers
Contributor

maybe this wil help?:

<form version="1.1">
  <label>tmp-pr-tags</label>
  <fieldset>
      <input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
      <label>Selecteer een PR_Tag:</label>
      <choice value="*">PR_Tags...</choice>
      <search>
        <query>
          <![CDATA[
           index=main sourcetype=csv source=result_test.csv 
           | table PR_Tags, PR_ID
           | eval PR_Tags=split(PR_Tags,",")
           | mvexpand PR_Tags
           | dedup PR_Tags PR_ID
          ]]>
        </query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <fieldForLabel>PR_Tags</fieldForLabel>
      <fieldForValue>PR_Tags</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>PR_Tags</title>
      <table>
        <search>
          <query>
           index=main sourcetype=csv source=result_test.csv 
           | where PR_Tags="$dropdown_tok$"
           | table PR_Tags, PR_ID
           | eval PR_Tags=split(PR_Tags,",")
           | mvexpand PR_Tags
           | dedup PR_Tags PR_ID
          </query>
        </search>
        <option name="count">50</option>
        <option name="drilldown">none</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...