Splunk Search

Based on user input, how to add conditionals to both base-query and regular query of a dashboard?

sthaker
Engager

Splunk dashboard: We have a dropdown with 2 possible values, option1 and option2.
Based on what user selects, (
option1: "A" or "B" ) gets added to both base-query and query OR 
option2: ("X" or "Y") gets added to both base-query and query. 

1. If user selects "option1", query is

<search id="base_query">

<query>index=logs sourcetype=ci "Shipping Finished" ("A" OR "B") ...</query>

<search base="base_query">

<query> | join some_field [ search index=logs sourcetype=ci | search ("A" OR "B") AND "Received complete status"

2. If user selects "option2", query is:

<search id="base_query">

<query>index=logs sourcetype=ci "Shipping Finished" ("X" OR "Y") ... </query>

<search base="base_query">

<query> | join some_field [ search index=logs sourcetype=ci | search ("X" OR "Y") AND "Received complete status"

Labels (1)
0 Karma

sthaker
Engager

Thanks ITWhisperer. This works. In the past I was adding () around my search strings due to which it didn't work.

Here's the correct way to define input dropdown, I added values as follows:

<input type="dropdown" token="ip_family" searchWhenChanged="true">
<label>IP Family</label>
<choice value="&quot;Foo&quot; OR &quot;Bar&quot;">option1</choice>

<choice value="&quot;Boo&quot; OR &quot;Baz&quot;">option2</choice>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your dropdown sets a token to a string. This string is substituted into your searches whenever it is mentioned.

<search id="base_query">
<query>index=logs sourcetype=ci "Shipping Finished" $token$ ...</query>

<search base="base_query">
<query> | join some_field [ search index=logs sourcetype=ci | search $token$ AND "Received complete status"
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...