Getting Data In

How to change data source dynamically

aamelyan
Explorer

Hi,

Is it possible to dynamically set the data source for the query below?
We have multiple environments and users want to run the same report against them by picking the environment from the drop down list on the report.

Production:
    | dbquery "InstrumentDB" "select top 10 * from Instrument.dbo.Program"

Staging:
    | dbquery "InstrumentDBStaging" "select top 10 * from Instrument.dbo.Program"
0 Karma
1 Solution

niketn
Legend

Following is a sample you can modify <query> as per your need

<form>
  <label>Dropdown to switch testQuery based on Dropdown value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selEnv">
      <label>Select Environment</label>
      <choice value="InstrumentDB">Stage</choice>
      <choice value="InstrumentDBStaging">Prod</choice>
      <default>InstrumentDB</default>
      <prefix></prefix>
      <suffix></suffix>
      <initialValue>InstrumentDB</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query> | makeresults | eval testQuery="| dbquery "  + "$selEnv$" + "\"select top 10 * from Instrument.dbo.Program\"" | table testQuery</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Following is a sample you can modify <query> as per your need

<form>
  <label>Dropdown to switch testQuery based on Dropdown value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selEnv">
      <label>Select Environment</label>
      <choice value="InstrumentDB">Stage</choice>
      <choice value="InstrumentDBStaging">Prod</choice>
      <default>InstrumentDB</default>
      <prefix></prefix>
      <suffix></suffix>
      <initialValue>InstrumentDB</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query> | makeresults | eval testQuery="| dbquery "  + "$selEnv$" + "\"select top 10 * from Instrument.dbo.Program\"" | table testQuery</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

aamelyan
Explorer

Something else is missing. I am not getting actual data outputted but the query itself. Am I missing extra setting?

The result

0 Karma

niketn
Legend

Yes that is because this example is just to show you that query is being passed as expected you will have to use the same in <search><query> tag in Simple XML.

For example:

 <search>
   <query> | dbquery  + "$selEnv$" + \"select top 10 * from Instrument.dbo.Program\"</query>
   <earliest>-60m@m</earliest>
   <latest>now</latest>
   <sampleRatio>1</sampleRatio>
 </search>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...