Getting Data In

Creating "Custom groups" and using them in a filter

andreafebbo
Communicator

I would like to do on splunk something similar to what in microstrategy is colled custom groups.

I'll try to explain it as simply as I can.

I have a field i use in a multiple selection filters.

ex: colours - yellow red white black blue etc...

This list of colours is VERY long, so it's quite uncomfortable for the users select in the multiple selection filters which colours he needs.

so id like to create a group of colours called "beauty" in which I specify which colour is beautiful e which is not.

ex:
beautiful colours: red blue green
ugly colours: all others

I'd like to do this outside of the single dashboard so i can use this for filtering in many dashboards.

Before reinventing the wheel I wanted to be sure there are not known solutions.

If there are not which ones you suggest.

Thanks a lot.

1 Solution

cmerriman
Super Champion

you can create a tag for this. then you can create a token in the dashboard for the tag

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineandusetags

but with multiple colors per tag, you might want to create an event type first and assign that event type to the tag

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineeventtypes#Save_a_search_as_a_new_...

View solution in original post

cmerriman
Super Champion

you can create a tag for this. then you can create a token in the dashboard for the tag

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineandusetags

but with multiple colors per tag, you might want to create an event type first and assign that event type to the tag

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Defineeventtypes#Save_a_search_as_a_new_...

cmerriman
Super Champion

as a for instance, you could have an eventtype called beauty, the search string would just be color=Red OR color=Blue OR color=Green Tag(s) could be called beauty. save that off. then create a tag by tag name. tag name could be called beauty and field value pair would be eventtype=beauty

andreafebbo
Communicator

I solved everything with an eventype.
Thank you!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...