Getting Data In

How to change data source dynamically

aamelyan
Explorer

Hi,

Is it possible to dynamically set the data source for the query below?
We have multiple environments and users want to run the same report against them by picking the environment from the drop down list on the report.

Production:
    | dbquery "InstrumentDB" "select top 10 * from Instrument.dbo.Program"

Staging:
    | dbquery "InstrumentDBStaging" "select top 10 * from Instrument.dbo.Program"
0 Karma
1 Solution

niketn
Legend

Following is a sample you can modify <query> as per your need

<form>
  <label>Dropdown to switch testQuery based on Dropdown value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selEnv">
      <label>Select Environment</label>
      <choice value="InstrumentDB">Stage</choice>
      <choice value="InstrumentDBStaging">Prod</choice>
      <default>InstrumentDB</default>
      <prefix></prefix>
      <suffix></suffix>
      <initialValue>InstrumentDB</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query> | makeresults | eval testQuery="| dbquery "  + "$selEnv$" + "\"select top 10 * from Instrument.dbo.Program\"" | table testQuery</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Following is a sample you can modify <query> as per your need

<form>
  <label>Dropdown to switch testQuery based on Dropdown value</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selEnv">
      <label>Select Environment</label>
      <choice value="InstrumentDB">Stage</choice>
      <choice value="InstrumentDBStaging">Prod</choice>
      <default>InstrumentDB</default>
      <prefix></prefix>
      <suffix></suffix>
      <initialValue>InstrumentDB</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query> | makeresults | eval testQuery="| dbquery "  + "$selEnv$" + "\"select top 10 * from Instrument.dbo.Program\"" | table testQuery</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

aamelyan
Explorer

Something else is missing. I am not getting actual data outputted but the query itself. Am I missing extra setting?

The result

0 Karma

niketn
Legend

Yes that is because this example is just to show you that query is being passed as expected you will have to use the same in <search><query> tag in Simple XML.

For example:

 <search>
   <query> | dbquery  + "$selEnv$" + \"select top 10 * from Instrument.dbo.Program\"</query>
   <earliest>-60m@m</earliest>
   <latest>now</latest>
   <sampleRatio>1</sampleRatio>
 </search>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...