Dashboards & Visualizations

how to remove where clause based on search input

merc14
Explorer

I have a search query that takes a search value from a drop down. 

Example

Drop down has values

All

A

B

Query uses 

| where productType="$dropdown$"

How do I remove the where clause if All is selected. There is no productType - All

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

merc14
Explorer

Thank you very much, replaced where with search and that worked like a charm

gcusello
SplunkTrust
SplunkTrust

Hi @merc14,

probably you're meaning that you could have events without the productType, obviously these events aren't matched by the All (*) value.

You could modify the input adding an additiona static value to search the events without productType.

If you could share the input code, I can be more detailed.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...