Dashboards & Visualizations

dynamic filter in WHERE statement

alessj
Engager

Hello,

I would like to use a dynamic filter. I have a dropdown($pool$) which select only one value from a list. I want to add a static value "all" that take all the values in the list.

Code working at this moment :
index source
| lookup bundle_3dexp.csv bundleid OUTPUTNEW bundleCode
| eval poolname=bundleCode+poolLetter
| where (poolname="$pool$" AND date >= "$time$")
| dedup login
| table login

How should i modify the code ? Adding an IF statement with the WHERE ?

Thanks you

0 Karma
1 Solution

wmyersas
Builder

First, as @skoelpin suggested, change from where to search

Second, create a static drop-down option named "All" with a value of "*"

Then when the | search poolname="$pool$" date>="$time$" runs, if you've selected "All" for the $pool$ dropdown, it will fill-in | search poolname="*" date>="$time$"

View solution in original post

0 Karma

wmyersas
Builder

First, as @skoelpin suggested, change from where to search

Second, create a static drop-down option named "All" with a value of "*"

Then when the | search poolname="$pool$" date>="$time$" runs, if you've selected "All" for the $pool$ dropdown, it will fill-in | search poolname="*" date>="$time$"

View solution in original post

0 Karma

alessj
Engager

i wasn't aware of search function

wmyersas
Builder

Now you are =D

0 Karma

skoelpin
SplunkTrust
SplunkTrust

where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search

Your token is rendered a value before getting passed to that search filter so you are comparing a field to a value.

0 Karma

wmyersas
Builder

where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search

That's not true. You can use multiple conditions in a where clause. You can do | where like(field,"%value%") AND field2<$token$ AND match(field3,"<regex>")...

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Have you tried changing where to search?

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!