Splunk Search
Highlighted

Decide between two queries?

New Member

I need to decide which token to use in a dashboard query (one or the other would be used for my "host" filed in the results) based on the value of one of the tokens. if I don't select a value for $tpod$ I want the query to use $thost$ but if I select a value for $t_pod$ I want to use that in the query.

index=MYINDEX subid=$tsubmissionID$ msg=$tmessageType$ host=$t_host$

index=MYINDEX subid=$tsubmissionID$ msg=$tmessageType$ host=%t_pod$

How can I decide which to use based on $t_pod$?

0 Karma

Re: Decide between two queries?

Path Finder

What is the placeholder value if there's no selection for one of those token? Is it a wildcard?

0 Karma
Highlighted

Re: Decide between two queries?

Builder

If you have text fields for both thost and tpod in your dashboard, this might help. It just shows the substitution.

<form>
  <label>tjsnow</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="t_pod">
      <label>t_pod</label>
      <default>default_t_pod</default>
      <initialValue>default_t_pod</initialValue>
      <change>
        <set token="t_pod">$value$</set>
      </change>
    </input>
    <input type="text" token="t_host">
      <label>t_host</label>
      <default></default>
      <change>
        <set token="t_host">$value$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval hostToken=if("$t_host$"=="","$t_pod$","$t_host$")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

In your example, you can then do something like this:

index=MYINDEX subid=$t_submissionID$ msg=$t_messageType$
| eval hostToken=if("$t_host$"=="","$t_pod$","$t_host$")
| where host=hostToken
0 Karma