Splunk Search

Based on user input, how to add conditionals to both base-query and regular query of a dashboard?

sthaker
Engager

Splunk dashboard: We have a dropdown with 2 possible values, option1 and option2.
Based on what user selects, (
option1: "A" or "B" ) gets added to both base-query and query OR 
option2: ("X" or "Y") gets added to both base-query and query. 

1. If user selects "option1", query is

<search id="base_query">

<query>index=logs sourcetype=ci "Shipping Finished" ("A" OR "B") ...</query>

<search base="base_query">

<query> | join some_field [ search index=logs sourcetype=ci | search ("A" OR "B") AND "Received complete status"

2. If user selects "option2", query is:

<search id="base_query">

<query>index=logs sourcetype=ci "Shipping Finished" ("X" OR "Y") ... </query>

<search base="base_query">

<query> | join some_field [ search index=logs sourcetype=ci | search ("X" OR "Y") AND "Received complete status"

Labels (1)
0 Karma

sthaker
Engager

Thanks ITWhisperer. This works. In the past I was adding () around my search strings due to which it didn't work.

Here's the correct way to define input dropdown, I added values as follows:

<input type="dropdown" token="ip_family" searchWhenChanged="true">
<label>IP Family</label>
<choice value="&quot;Foo&quot; OR &quot;Bar&quot;">option1</choice>

<choice value="&quot;Boo&quot; OR &quot;Baz&quot;">option2</choice>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your dropdown sets a token to a string. This string is substituted into your searches whenever it is mentioned.

<search id="base_query">
<query>index=logs sourcetype=ci "Shipping Finished" $token$ ...</query>

<search base="base_query">
<query> | join some_field [ search index=logs sourcetype=ci | search $token$ AND "Received complete status"
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...