Dashboards & Visualizations

dynamic filter in WHERE statement

alessj
Engager

Hello,

I would like to use a dynamic filter. I have a dropdown($pool$) which select only one value from a list. I want to add a static value "all" that take all the values in the list.

Code working at this moment :
index source
| lookup bundle_3dexp.csv bundleid OUTPUTNEW bundleCode
| eval poolname=bundleCode+poolLetter
| where (poolname="$pool$" AND date >= "$time$")
| dedup login
| table login

How should i modify the code ? Adding an IF statement with the WHERE ?

Thanks you

0 Karma
1 Solution

wmyersas
Builder

First, as @skoelpin suggested, change from where to search

Second, create a static drop-down option named "All" with a value of "*"

Then when the | search poolname="$pool$" date>="$time$" runs, if you've selected "All" for the $pool$ dropdown, it will fill-in | search poolname="*" date>="$time$"

View solution in original post

0 Karma

wmyersas
Builder

First, as @skoelpin suggested, change from where to search

Second, create a static drop-down option named "All" with a value of "*"

Then when the | search poolname="$pool$" date>="$time$" runs, if you've selected "All" for the $pool$ dropdown, it will fill-in | search poolname="*" date>="$time$"

0 Karma

alessj
Engager

i wasn't aware of search function

wmyersas
Builder

Now you are =D

0 Karma

skoelpin
SplunkTrust
SplunkTrust

where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search

Your token is rendered a value before getting passed to that search filter so you are comparing a field to a value.

0 Karma

wmyersas
Builder

where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search

That's not true. You can use multiple conditions in a where clause. You can do | where like(field,"%value%") AND field2<$token$ AND match(field3,"<regex>")...

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Have you tried changing where to search?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...