Reporting

Using OR in a pivot query

angersleek
Path Finder

I have a data set with following query and it is saved as "model_requests"

(service=service* OR (service=Aservice* AND app_name=app*)) some_other_fields=*

Under my dash boards I have a single value chart with following query:

| pivot model_requests RootObject count(RootObject) AS "Count of Requests" FILTER service in $service_token$

$service_token$ points to a drop down in the dashboard, which has different service names or * which is a list of a set of services.
Example drop down options under static options:

Name         Value
*            (Service1, Service2)
Service1     Service1
Service2     Service2

I have added a new drop down for app_name and its token name is $app_token$ as follows:

Name     Value
*        (app1, app2)
app1     app1
app2     app2

In the pivot query, I am looking to have an OR in it to choose between the tokens service_token and app_token (Either or, both tokens data will not exists at the same time).
For example as follows:

| pivot model_requests RootObject count(RootObject) AS "Count of Requests" (FILTER service in $service_token$ OR FILTER app_name in $app_token$) FILTER something_else=*

This query doesn't work. Is there a way around this? Thanks.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...

Data Management Digest – June 2026

Welcome to the June 2026 edition of Data Management Digest! This month’s update is short and sweet, with a ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...