Splunk Search

Based on user input, how to add conditionals to both base-query and regular query of a dashboard?

sthaker
Engager

Splunk dashboard: We have a dropdown with 2 possible values, option1 and option2.
Based on what user selects, (
option1: "A" or "B" ) gets added to both base-query and query OR 
option2: ("X" or "Y") gets added to both base-query and query. 

1. If user selects "option1", query is

<search id="base_query">

<query>index=logs sourcetype=ci "Shipping Finished" ("A" OR "B") ...</query>

<search base="base_query">

<query> | join some_field [ search index=logs sourcetype=ci | search ("A" OR "B") AND "Received complete status"

2. If user selects "option2", query is:

<search id="base_query">

<query>index=logs sourcetype=ci "Shipping Finished" ("X" OR "Y") ... </query>

<search base="base_query">

<query> | join some_field [ search index=logs sourcetype=ci | search ("X" OR "Y") AND "Received complete status"

Labels (1)
0 Karma

sthaker
Engager

Thanks ITWhisperer. This works. In the past I was adding () around my search strings due to which it didn't work.

Here's the correct way to define input dropdown, I added values as follows:

<input type="dropdown" token="ip_family" searchWhenChanged="true">
<label>IP Family</label>
<choice value="&quot;Foo&quot; OR &quot;Bar&quot;">option1</choice>

<choice value="&quot;Boo&quot; OR &quot;Baz&quot;">option2</choice>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your dropdown sets a token to a string. This string is substituted into your searches whenever it is mentioned.

<search id="base_query">
<query>index=logs sourcetype=ci "Shipping Finished" $token$ ...</query>

<search base="base_query">
<query> | join some_field [ search index=logs sourcetype=ci | search $token$ AND "Received complete status"
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...