Getting Data In

Working with two filters for one event row

vtsguerrero
Contributor

I have one drop down and one text input, I need the user to be able to by both components OR INDIVIDUAL, one optional and they are both used for just one event row...

index=main source type=main_error ChannelCode=$channel$ OR ProcessCode=$process$

Can anyone explain this search string to me ?
Thanks in advance!

0 Karma

somesoni2
Revered Legend

You can use the value as "*" for the dropdown/text box so that if User doesn't selects a filter, its default value * will be supplied.

E.g. dashboard

Updated

 <form>
  <label>DynamicChartTitle</label>
  <description>NULL</description>
  <fieldset autoRun="true">
    <input type="dropdown" token="sourcetype" searchWhenChanged="false">
      <label>Sourcetype</label>
      <choice value="*">All</choice>
      <default>*</default>
      <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
        <![CDATA[index=_internal earliest=-1h@h | stats count by sourcetype | table sourcetype ]]>
      </populatingSearch>
    </input>
    <input type="text" token="source" searchWhenChanged="true">
      <label>Source</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <table>
      <title>The chart tile</title>
      <searchString>index=_internal [|gentimes start=-1 
        | eval search=if("$sourcetype$"="*","","sourcetype=\"$sourcetype$\"")
        | eval search=case("$source$"="*",search, search !="",search." OR source=\"$source$\"",1=1,"source=\"$source$\"") | table search]
        | stats count by sourcetype, source</searchString>
      <earliestTime>-1h</earliestTime>
      <latestTime>now</latestTime>            
    </table>
  </row>
</form>

somesoni2
Revered Legend

I had overlooked the OR condition between two filters. I have added some logic to handle that situation. Try the updated answer.

0 Karma

tom_frotscher
Builder

This is a good approach in general for the mentioned problem. But can't there be some side effects in this special case? Because the fields are combined with the OR operator.

0 Karma

vtsguerrero
Contributor

When searching using a searchString, it's only searching if user choose a dropdown value and also type something in the text input, and I wanted to be able to search individually independent.

0 Karma

strive
Influencer

Do you mean "both the fields to be mandatory". In you search with that OR condition, even if user gives any one input the search will execute.

0 Karma

vtsguerrero
Contributor

Sorry when I said filter, I meant two inputs...

0 Karma

vtsguerrero
Contributor

It's only searching both mandatory :X

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...