Dashboards & Visualizations

on a dashboard and searchTemplate

asarolkar
Builder

I have one user interactive input from a < form > that needs to go to two searches - wherever it gets a match must display in the form of a table.

I have created a dashboard and can pass in an ID using < searchTemplate> and < fieldset > - basically I pass a token by the name of $ID$ into the search inside the searchTemplate.

However searchTemplate only ever takes in one search - for me there's TWO sourcetypes - if I cannot get this id from Sourcetype A I need to be able to look in Sourcetype B - how would I accomplish that in one form using ONE actual search entry into < searchTemplate> ?

Something like this ---->

< searchtemplate >

sourcetype="A" idInTableA="$ID$"

sourcetype="B" idInTableB="$ID$"

< /searchtemplate >

Any ideas so as to the most sensible way to go about this ?

0 Karma

asarolkar
Builder

That by the way, did not work.

Splunk errors out saying it is unable to parse the search

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
(sourcetype=A idInTableA="$ID$") OR (sourcetype=B idInTableB="$ID$")

?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...