Splunk Search

How can we run searches based on token value?

goyals05
Explorer

I have two different searches and i want to run those searches based on the token.

if any value is set for that token then Query 1 should run, else Query 2 should run.

cmakepeace_splu
Splunk Employee
Splunk Employee

An easy solution is to actually use the tokens that are created from a conditional statement on the dropdown menu within the actual search. These value and field is then immediately removed from the results. This works as the search will not run until the all tokens present within the search are set.

     <form>
       <fieldset submitButton="false">
         <input type="radio" token="sample_radio">
           <label>Select which search</label>
           <choice value="search1">search 1</choice>
           <choice value="search2">search 2</choice>
           <default></default>
           <change>
             <condition value="search1">
               <set token="search_one"></set>
               <unset token="search_two"></unset>
             </condition>
             <condition value="search2">
               <unset token="search_one"></unset>
               <set token="search_two"></set>
             </condition>
           </change>
         </input>
       </fieldset>
       <row>
         <panel>    
           <chart  depends="$search_one$">
             <title>Search One</title>
             <search>
               <query>Query 1 | eval temp=$search_one$ | fields - temp</query>
               <earliest>-15m@m</earliest>
               <latest>now</latest>
             </search>
           </chart>
           <chart depends="$search_two$">
             <title>Search Two</title>
             <search>
               <query>Query 2 | eval temp=$search_two$ | fields - temp</query>
               <earliest>-1d@d</earliest>
               <latest>now</latest>
             </search>
           </chart>
         </panel>
       </row>
     </form>
0 Karma

lguinn2
Legend

Perhaps something like this would work for you. This defines a dashboard with one input. There are two charts, but only one chart appears. The chart that appears is based on the user input.

<form>
  <fieldset submitButton="false">
    <input type="radio" token="period_tok">
      <label>Select a time range</label>
      <choice value="search1">Search One Description</choice>
      <choice value="search2">Search Two Description</choice>
      <default>Search One Description</default>
      <change>
        <condition value="search1">
          <set token="show_searchOne">any value</set>
          <unset token="show_searchTwo"></unset>
        </condition>
        <condition value="search2">
          <unset token="show_searchOne"></unset>
          <set token="show_searchTwo">any value</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>    
      <chart  depends="$show_searchOne$">
        <title>Search One</title>
        <search>
          <query>index = _internal | timechart count by sourcetype</query>
          <earliest>-15m@m</earliest>
          <latest>now</latest>
        </search>
      </chart>
      <chart depends="$show_searchTwo$">
        <title>Search Two</title>
        <search>
          <query>index = _internal | timechart count by source</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
        </search>
      </chart>
    </panel>
  </row>
</form>

goyals05
Explorer

Thanks but my requirement is slightly different. In below example if value of LIVE_or_DROP is set then Query 1 should be run otherwise Query 2 should be run.

      <set token="LIVE_or_DROP">LIVE</set>



<query>Query 1</query>
      <earliest>abc</earliest>
      <latest>xyz</latest>
<finalized>
        <set token="x">$result.total$</set>



<query>Query 2</query>
      <earliest>abc</earliest>
      <latest>xyz</latest>
<finalized>
        <set token="x">$result.total$</set>
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...