Dashboards & Visualizations

dynamic filter in WHERE statement

alessj
Engager

Hello,

I would like to use a dynamic filter. I have a dropdown($pool$) which select only one value from a list. I want to add a static value "all" that take all the values in the list.

Code working at this moment :
index source
| lookup bundle_3dexp.csv bundleid OUTPUTNEW bundleCode
| eval poolname=bundleCode+poolLetter
| where (poolname="$pool$" AND date >= "$time$")
| dedup login
| table login

How should i modify the code ? Adding an IF statement with the WHERE ?

Thanks you

0 Karma
1 Solution

wmyersas
Builder

First, as @skoelpin suggested, change from where to search

Second, create a static drop-down option named "All" with a value of "*"

Then when the | search poolname="$pool$" date>="$time$" runs, if you've selected "All" for the $pool$ dropdown, it will fill-in | search poolname="*" date>="$time$"

View solution in original post

0 Karma

wmyersas
Builder

First, as @skoelpin suggested, change from where to search

Second, create a static drop-down option named "All" with a value of "*"

Then when the | search poolname="$pool$" date>="$time$" runs, if you've selected "All" for the $pool$ dropdown, it will fill-in | search poolname="*" date>="$time$"

View solution in original post

0 Karma

alessj
Engager

i wasn't aware of search function

wmyersas
Builder

Now you are =D

0 Karma

skoelpin
SplunkTrust
SplunkTrust

where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search

Your token is rendered a value before getting passed to that search filter so you are comparing a field to a value.

0 Karma

wmyersas
Builder

where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search

That's not true. You can use multiple conditions in a where clause. You can do | where like(field,"%value%") AND field2<$token$ AND match(field3,"<regex>")...

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Have you tried changing where to search?

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.