Splunk Search

Dashboard token value substitution

randy_moore
Path Finder

Hi  I have a input token in my dashboard for register number called $tok_reg_num$.
The customers can put in a specific number or leave it as the default of "*".   

Here's the issue,  in one of the dashboard searches I can use the default of "*"   (e..g  index=blah sourcetype=blahblah register_number=*),  in a secondary panel  I have to use a where  with a LIKE clause due to the different log type to filter the register number so * won't work and I need to change it to a  %.   

Non-working:
| Where customer="foo" AND like(Register,"*")  <--the  dashboard default for  $tok_reg_num$

I want it to be this:
| Where customer="foo" AND like(Register,"%")  <- change the $tok_reg_num$ to %

I have exhausted my meager splunk token experience in trying to get this to work. 
I can't figure out if I can examine and change it in the search  or do I need to do that  on the dashboard.   Someone give me a nudge in the right direction, please 

Labels (1)
Tags (2)
0 Karma
1 Solution

justinatpnnl
Communicator

Edited after I learned to read:

You should be able to use the replace function for this:

 

| where customer="foo" AND like(Register,replace("$tok_reg_num$", "\*", "%"))

 

Original Reply:

Try using searchmatch in your where statement.  It will take a regular SPL search statement and is compatible with the asterisk as the wild card.

 

| where customer="foo" AND searchmatch("Register=\"$tok_reg_num$\"")

 

View solution in original post

justinatpnnl
Communicator

Edited after I learned to read:

You should be able to use the replace function for this:

 

| where customer="foo" AND like(Register,replace("$tok_reg_num$", "\*", "%"))

 

Original Reply:

Try using searchmatch in your where statement.  It will take a regular SPL search statement and is compatible with the asterisk as the wild card.

 

| where customer="foo" AND searchmatch("Register=\"$tok_reg_num$\"")

 

randy_moore
Path Finder

Replace was the trick @justinatpnnl .    Worked perfectly.   Many many thanks!

Randy

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...