Dashboards & Visualizations

how to remove where clause based on search input

merc14
Explorer

I have a search query that takes a search value from a drop down. 

Example

Drop down has values

All

A

B

Query uses 

| where productType="$dropdown$"

How do I remove the where clause if All is selected. There is no productType - All

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

merc14
Explorer

Thank you very much, replaced where with search and that worked like a charm

gcusello
SplunkTrust
SplunkTrust

Hi @merc14,

probably you're meaning that you could have events without the productType, obviously these events aren't matched by the All (*) value.

You could modify the input adding an additiona static value to search the events without productType.

If you could share the input code, I can be more detailed.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...