Splunk Search

Can you change the base search depending on a drop down value?

replicant
Engager

I have a dashboard that uses a dbxquery in the base search.  I would like to make the dashboard "bilingual".

Is it possible to alter the behavior of the dashboard and select a different base search depending on the value of a drop down or radio button?

For example, selecting the first of the two options should have this base search be used:

<search id="base1">
<query>| dbxquery shortnames=true output=csv connection="CON_1" query="use [DB1] select TimeRaised as 'TimeTriggered', ...</query>

...while selecting the 2nd of the two options would use this one:

<search id="base1">
<query>| dbxquery shortnames=true output=csv connection="CON_2" query="use [DB2] select TimeRaised as 'TimeTriggered', ...</query>

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

replicant
Engager

@richgalloway - Perfect.  Karma given.  Thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Rather than change the base search, consider changing parameters of the search.  If this is the base search

<query>| dbxquery shortnames=true output=csv connection=$CON|S$ query="use [$DB$] select TimeRaised as 'TimeTriggered', ...</query>

then you just need the dropdown selector to set the $CON$ and $DB$ tokens to the appropriate values.

<input type="dropdown" ...>
  ...
  <change>
    <condition label="Choice 1">
      <set token="CON">CON1</set>
      <set token="DB">DB1</set>
    </condition>
    <condition label="Choice 2">
      <set token="CON">CON2</set>
      <set token="DB">DB2</set>
    </condition>
  </change>
</input>
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...