Dashboards & Visualizations

where to add token in my search string which is a join of two indexes

radha116
Explorer

I have a query as below 

 

I have a table with below search string:

index="apple" | table "ID"
| join type=left ID [search index="csv"] | table  "ID" "Type" "Status"
** Type is in csv index table

created a dropdown for type with token = type_filter. 

On the above search string where should I include the token to function my dropdown.

 

 

 

Labels (1)
0 Karma
1 Solution

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

View solution in original post

0 Karma

radha116
Explorer

Type dropdown has options fruits, vegetables. When i select fruits i want to see the table filtered with Type: fruit.

 

index="apple" | table "ID"
| join type=left ID [search index="csv"  "$type_filter$"] | table  "ID" "Type" "Status"

is the above correct

Tags (1)
0 Karma

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to exclude with the token. Do you want IDs from apple with data from csv regardless of whether they have a match to the token in csv or do you want to exclude IDs from apple if they have a match to the token in a field from csv?

If you want the first case you would put the exclusion inside the join search, if you want the second case you would put the exclusion outside / after the join search.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...