Reporting

Return values from savedsearch and pass it to another savedsearch

madakkas
Explorer

I have such a ‘savedsearch’ and I would want to pass on 3 variables into the query when I select an option from the dropdown menu.

For Example –

When I Select
Option 1 – I should be able to run the below query with CODE1=A1 CODE2=B1 and CODE3=C1
Option 2- I should be able to run the below query with CODE1=A2 CODE2=B2 and CODE3=C3

The below query is saved as Mismatch_Report
index=myindex MFSOURCETYPE= $code1$ | append [search MFSOURCETYPE ="code2$" ]
| replace "DATA" with "" in DATA as DATA | replace "," with "" in DATA as DATA |replace "." with "-" in DATA as DATA
| replace $code1$ with "Neighbour Dates" in MFSOURCETYPE as MFSOURCETYPE | replace "$code2$" with "My Dates" in MFSOURCETYPE as MFSOURCETYPE
| table DATA MFSOURCETYPE | dedup DATA MFSOURCETYPE | chart count over DATA by MFSOURCETYPE
| foreach * [eval "<>"=case('<>'=0,"Not in list ", '<>'=1,"Matched ",true(),'<>') ]
| eval keep="Y"
| foreach * [eval keep=if('<>'="Not in list ","N",keep)]
| where keep="N"
| fields - keep |eval country = "$code3$" | eval _status = "Non Matched Row"

Also I have the below query – eval_codes
|eval app=case($REGION$ = "VAL1","MF11",
$REGION$ = "VAL2" ,"MF12",
1==1,"0")
|eval ca7=case($REGION$ = "VAL1","MF21 ",
$REGION$ = "VAL2" ,"MF22",
1==1,"0")
|eval ctry=case($REGION$ = "VAL1","N1",
$REGION$ = "VAL2" ,"N2",
1==1,"0")

Dashboard as below, and my intention here is to take the user input via the dropdown and then evaluate the codes as per in eval_codes and then send then re-use them in savedsearch Mismatch_Report

<input type="dropdown" token="REGION" searchWhenChanged="true">
  <label>Select a User:</label>
  <default>CBS</default>
  <!-- Define the choices in code -->
  <choice value="VAL1">OPT 1</choice>
  <choice value="VAL2">OPT 2</choice>
</input>
<panel>
  <title>COUNTRY CALENDAR</title>
  <table>
    <search>
      <query>
        |savedsearch eval_codes REGION=$REGION$ |append [search
         savedsearch Mismatch_Report appcode=app ca7code=ca7 ccntry=ctry]
      </query>
    </search>
  </table>
</panel>
0 Karma
1 Solution

493669
Super Champion

Hi @madakkas,
Try This:

<input type="dropdown" token="REGION" searchWhenChanged="true">
   <label>Select a User:</label>
   <default>CBS</default>
   <!-- Define the choices in code -->
   <choice value="VAL1">OPT 1</choice>
   <choice value="VAL2">OPT 2</choice>
<change>
        <condition label="OPT 1">
          <set token="CODE1">A1</set>
         <set token="CODE2">B1</set>
         <set token="CODE3">C1</set>
         <set token="REGION">$value$</set>
        </condition>
        <condition label="OPT 2">
         <set token="CODE1">A2</set>
         <set token="CODE2">B2</set>
         <set token="CODE3">C2</set>
         <set token="REGION">$value$</set>
        </condition>
      </change>
 </input>
<panel>
   <title>COUNTRY CALENDAR</title>
   <table>
     <search>
       <query>
         |savedsearch eval_codes REGION=$REGION$ |append [search
          savedsearch Mismatch_Report appcode=app ca7code=ca7 ccntry=ctry]
       </query>
     </search>
   </table>
 </panel>

Hope this helps!

View solution in original post

0 Karma

493669
Super Champion

Hi @madakkas,
Try This:

<input type="dropdown" token="REGION" searchWhenChanged="true">
   <label>Select a User:</label>
   <default>CBS</default>
   <!-- Define the choices in code -->
   <choice value="VAL1">OPT 1</choice>
   <choice value="VAL2">OPT 2</choice>
<change>
        <condition label="OPT 1">
          <set token="CODE1">A1</set>
         <set token="CODE2">B1</set>
         <set token="CODE3">C1</set>
         <set token="REGION">$value$</set>
        </condition>
        <condition label="OPT 2">
         <set token="CODE1">A2</set>
         <set token="CODE2">B2</set>
         <set token="CODE3">C2</set>
         <set token="REGION">$value$</set>
        </condition>
      </change>
 </input>
<panel>
   <title>COUNTRY CALENDAR</title>
   <table>
     <search>
       <query>
         |savedsearch eval_codes REGION=$REGION$ |append [search
          savedsearch Mismatch_Report appcode=app ca7code=ca7 ccntry=ctry]
       </query>
     </search>
   </table>
 </panel>

Hope this helps!

0 Karma

madakkas
Explorer

You were to the point and your solution did what i just needed .

thank You -- 493669

0 Karma

493669
Super Champion

glad to help you 🙂

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...