Dashboards & Visualizations

where to add token in my search string which is a join of two indexes

radha116
Explorer

I have a query as below 

 

I have a table with below search string:

index="apple" | table "ID"
| join type=left ID [search index="csv"] | table  "ID" "Type" "Status"
** Type is in csv index table

created a dropdown for type with token = type_filter. 

On the above search string where should I include the token to function my dropdown.

 

 

 

Labels (1)
0 Karma
1 Solution

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

View solution in original post

0 Karma

radha116
Explorer

Type dropdown has options fruits, vegetables. When i select fruits i want to see the table filtered with Type: fruit.

 

index="apple" | table "ID"
| join type=left ID [search index="csv"  "$type_filter$"] | table  "ID" "Type" "Status"

is the above correct

Tags (1)
0 Karma

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to exclude with the token. Do you want IDs from apple with data from csv regardless of whether they have a match to the token in csv or do you want to exclude IDs from apple if they have a match to the token in a field from csv?

If you want the first case you would put the exclusion inside the join search, if you want the second case you would put the exclusion outside / after the join search.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...