Splunk Search

Different query's based on the result of previous Token

splunk_exercice
New Member

Hello,

I have a doubt that I think it´s easy to respond, but until now, I have no results.
I want to make an query that depends on the result of a token, example:

  • If the token is set to yeallow,
    • then the following query will be executed: index=a | stats count by field.name1
  • If the token is set to red,
    • then the following query will be executed: index=b | stats count by field.name2, field.name4
  • If the toke is set to green,
    • then the following query will be executed: index=c | stats count by field.name3, field.name5, field.name6

How can I achieve this?

Thanks in advance.

Best regards.

Tags (1)
0 Karma

harishalipaka
Motivator
<form>
  <label>Sample</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="selected" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="field.name1">Yellow</choice>
      <choice value="field.name2, field.name4">red</choice>
      <choice value="field.name3, field.name5, field.name6">green</choice>
      <default>Yellow</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>|stats count by $selected$</title>
      <single>
        <search>
          <query>|makeresults |eval tokenvalue="$selected$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>
Thanks
Harish
0 Karma

vasanthmss
Motivator

Hi,

This can be achieve by a simple token you can use refer the below sample.

Description:

Token named "token" can be set to the search based on user selection. With this example i've used the internal index, you may want to try with your index.

Note: This sample will run only you
have access to internal index.

<form>
  <label>Sample</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="token" searchWhenChanged="true">
      <label>Your Token</label>
      <choice value="index=_internal | head 10 | stats c by host">host</choice>
      <choice value="index=_internal | head 10 | stats c by sourcetype, host">sourcetype, host</choice>
      <choice value="index=_internal | head 10 | stats c by source, host, sourcetype">source, host, sourcetype</choice>
      <default>index=_internal | head 10 | stats c by host</default>
      <initialValue>index=_internal | head 10 | stats c by host</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$token$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Thanks,
V

V
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...