Splunk Search

Different query's based on the result of previous Token

splunk_exercice
New Member

Hello,

I have a doubt that I think it´s easy to respond, but until now, I have no results.
I want to make an query that depends on the result of a token, example:

  • If the token is set to yeallow,
    • then the following query will be executed: index=a | stats count by field.name1
  • If the token is set to red,
    • then the following query will be executed: index=b | stats count by field.name2, field.name4
  • If the toke is set to green,
    • then the following query will be executed: index=c | stats count by field.name3, field.name5, field.name6

How can I achieve this?

Thanks in advance.

Best regards.

Tags (1)
0 Karma

harishalipaka
Motivator
<form>
  <label>Sample</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selected" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="field.name1">Yellow</choice>
      <choice value="field.name2, field.name4">red</choice>
      <choice value="field.name3, field.name5, field.name6">green</choice>
      <default>Yellow</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>|stats count by $selected$</title>
      <single>
        <search>
          <query>|makeresults |eval tokenvalue="$selected$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>
Thanks
Harish
0 Karma

vasanthmss
Motivator

Hi,

This can be achieve by a simple token you can use refer the below sample.

Description:

Token named "token" can be set to the search based on user selection. With this example i've used the internal index, you may want to try with your index.

Note: This sample will run only you
have access to internal index.

<form>
  <label>Sample</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="token" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="index=_internal | head 10 | stats c by host">host</choice>
      <choice value="index=_internal | head 10 | stats c by sourcetype, host">sourcetype, host</choice>
      <choice value="index=_internal | head 10 | stats c by source, host, sourcetype">source, host, sourcetype</choice>
      <default>index=_internal | head 10 | stats c by host</default>
      <initialValue>index=_internal | head 10 | stats c by host</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$token$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Thanks,
V

V
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...