Dashboards & Visualizations

how to remove where clause based on search input

merc14
Explorer

I have a search query that takes a search value from a drop down. 

Example

Drop down has values

All

A

B

Query uses 

| where productType="$dropdown$"

How do I remove the where clause if All is selected. There is no productType - All

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

merc14
Explorer

Thank you very much, replaced where with search and that worked like a charm

gcusello
SplunkTrust
SplunkTrust

Hi @merc14,

probably you're meaning that you could have events without the productType, obviously these events aren't matched by the All (*) value.

You could modify the input adding an additiona static value to search the events without productType.

If you could share the input code, I can be more detailed.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...