Splunk Search

Based on user input, how to add conditionals to both base-query and regular query of a dashboard?

sthaker
Engager

Splunk dashboard: We have a dropdown with 2 possible values, option1 and option2.
Based on what user selects, (
option1: "A" or "B" ) gets added to both base-query and query OR 
option2: ("X" or "Y") gets added to both base-query and query. 

1. If user selects "option1", query is

<search id="base_query">

<query>index=logs sourcetype=ci "Shipping Finished" ("A" OR "B") ...</query>

<search base="base_query">

<query> | join some_field [ search index=logs sourcetype=ci | search ("A" OR "B") AND "Received complete status"

2. If user selects "option2", query is:

<search id="base_query">

<query>index=logs sourcetype=ci "Shipping Finished" ("X" OR "Y") ... </query>

<search base="base_query">

<query> | join some_field [ search index=logs sourcetype=ci | search ("X" OR "Y") AND "Received complete status"

Labels (1)
0 Karma

sthaker
Engager

Thanks ITWhisperer. This works. In the past I was adding () around my search strings due to which it didn't work.

Here's the correct way to define input dropdown, I added values as follows:

<input type="dropdown" token="ip_family" searchWhenChanged="true">
<label>IP Family</label>
<choice value="&quot;Foo&quot; OR &quot;Bar&quot;">option1</choice>

<choice value="&quot;Boo&quot; OR &quot;Baz&quot;">option2</choice>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your dropdown sets a token to a string. This string is substituted into your searches whenever it is mentioned.

<search id="base_query">
<query>index=logs sourcetype=ci "Shipping Finished" $token$ ...</query>

<search base="base_query">
<query> | join some_field [ search index=logs sourcetype=ci | search $token$ AND "Received complete status"
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...