Splunk Search

Extract fields from drop down option and use in search

thenormalone
Path Finder

I have a drop down in my dashboard which looks up a csv file having client information in one of the rows named domain and is of the form "<number>.<client_name>.<network>".

Eg: s122.clientA.cmbs.com

My drop down is configured as below

 

<input type="dropdown" token="token" searchWhenChanged="true">
<label>Client</label>
<choice value="*">All</choice>
<initialValue>*</initialValue>
<fieldForLabel>display</fieldForLabel>
<fieldForValue>domain</fieldForValue>
<search>
<query>| inputlookup domains.csv</query>
<earliest>0</earliest>
<latest></latest>
</search>
<default>*</default>
</input>

 


Then in my search, I'm just appending "... AND client=$domain$" but in this case the domain value will be client=s122.clientA.cmbs.com. How do I extract only the client name from the drop down and use that in the search instead? 

Eg: client=*clientA* should be appended to the search after extraction instead of the whole string (client=*s122.clientA.cmbs.com*)

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Edit the search query to extract the client.

<input type="dropdown" token="token" searchWhenChanged="true">
<label>Client</label>
<choice value="*">All</choice>
<initialValue>*</initialValue>
<fieldForLabel>display</fieldForLabel>
<fieldForValue>client</fieldForValue>
<search>
<query>| inputlookup domains.csv
| eval client=mvindex(split(domain),"."),0)</query>
<earliest>0</earliest>
<latest></latest>
</search>
<default>*</default>
</input>
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Edit the search query to extract the client.

<input type="dropdown" token="token" searchWhenChanged="true">
<label>Client</label>
<choice value="*">All</choice>
<initialValue>*</initialValue>
<fieldForLabel>display</fieldForLabel>
<fieldForValue>client</fieldForValue>
<search>
<query>| inputlookup domains.csv
| eval client=mvindex(split(domain),"."),0)</query>
<earliest>0</earliest>
<latest></latest>
</search>
<default>*</default>
</input>
---
If this reply helps you, Karma would be appreciated.

thenormalone
Path Finder

I was able to get it by slightly altering the search

| eval client=mvindex(split(domain,"."),1)

 

Thanks!

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...