Dashboards & Visualizations

What is the most efficient way to use dashboard tokens for filtering?

bcarr12
Path Finder

I have a dashboard where I am using tokens to filter the results of the individual panels. The use case for the filters are:

Token=anything (*)
Token=specific_value
Token=anything BUT specific_value

I have the first two tested and working, but can't seem to figure out the best way to account for the 3rd scenario. I have been incorporating the token into my searches by using:

| fillnull value=NULL field (this ensures value will always be equal to something, even when not in an event) | search field=$token$

This works great for scenario 1 and 2 but obviously there is no way (I think?) to leverage field=value when in the last case I want to do the opposite (!=). Is there a better way to leverage the token in my search so I will be able to filter based on all three scenarios? All values, specific value, everything NOT specific value?

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Your token should include the condition you want to check, including the field name, and then just use the token value in the search. e.g.

Token=>field=*
Token=>field=specific_value
Token=field!=specific_value

And your search should be like

| fillnull value=NULL field (this ensures value will always be equal to something, even when not in an event) | search $token$

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Your token should include the condition you want to check, including the field name, and then just use the token value in the search. e.g.

Token=>field=*
Token=>field=specific_value
Token=field!=specific_value

And your search should be like

| fillnull value=NULL field (this ensures value will always be equal to something, even when not in an event) | search $token$
0 Karma

bcarr12
Path Finder

I wish there was a facepalm emoji available so I could use it 🙂

I never even considered the option of using the token to specify the entire condition, I always thought it could only be used to specify a specific value. All good, this did the trick!

0 Karma

niketn
Legend

@bcarr12 if your issue is resolved please accept the answer to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...