Splunk Search

Different query's based on the result of previous Token

splunk_exercice
New Member

Hello,

I have a doubt that I think it´s easy to respond, but until now, I have no results.
I want to make an query that depends on the result of a token, example:

  • If the token is set to yeallow,
    • then the following query will be executed: index=a | stats count by field.name1
  • If the token is set to red,
    • then the following query will be executed: index=b | stats count by field.name2, field.name4
  • If the toke is set to green,
    • then the following query will be executed: index=c | stats count by field.name3, field.name5, field.name6

How can I achieve this?

Thanks in advance.

Best regards.

Tags (1)
0 Karma

harishalipaka
Motivator
<form>
  <label>Sample</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selected" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="field.name1">Yellow</choice>
      <choice value="field.name2, field.name4">red</choice>
      <choice value="field.name3, field.name5, field.name6">green</choice>
      <default>Yellow</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>|stats count by $selected$</title>
      <single>
        <search>
          <query>|makeresults |eval tokenvalue="$selected$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>
Thanks
Harish
0 Karma

vasanthmss
Motivator

Hi,

This can be achieve by a simple token you can use refer the below sample.

Description:

Token named "token" can be set to the search based on user selection. With this example i've used the internal index, you may want to try with your index.

Note: This sample will run only you
have access to internal index.

<form>
  <label>Sample</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="token" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="index=_internal | head 10 | stats c by host">host</choice>
      <choice value="index=_internal | head 10 | stats c by sourcetype, host">sourcetype, host</choice>
      <choice value="index=_internal | head 10 | stats c by source, host, sourcetype">source, host, sourcetype</choice>
      <default>index=_internal | head 10 | stats c by host</default>
      <initialValue>index=_internal | head 10 | stats c by host</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$token$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Thanks,
V

V
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...