Dashboards & Visualizations

how to remove where clause based on search input

merc14
Explorer

I have a search query that takes a search value from a drop down. 

Example

Drop down has values

All

A

B

Query uses 

| where productType="$dropdown$"

How do I remove the where clause if All is selected. There is no productType - All

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

merc14
Explorer

Thank you very much, replaced where with search and that worked like a charm

gcusello
SplunkTrust
SplunkTrust

Hi @merc14,

probably you're meaning that you could have events without the productType, obviously these events aren't matched by the All (*) value.

You could modify the input adding an additiona static value to search the events without productType.

If you could share the input code, I can be more detailed.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...