Splunk Search

How can we run searches based on token value?

goyals05
Explorer

I have two different searches and i want to run those searches based on the token.

if any value is set for that token then Query 1 should run, else Query 2 should run.

cmakepeace_splu
Splunk Employee
Splunk Employee

An easy solution is to actually use the tokens that are created from a conditional statement on the dropdown menu within the actual search. These value and field is then immediately removed from the results. This works as the search will not run until the all tokens present within the search are set.

     <form>
       <fieldset submitButton="false">
         <input type="radio" token="sample_radio">
           <label>Select which search</label>
           <choice value="search1">search 1</choice>
           <choice value="search2">search 2</choice>
           <default></default>
           <change>
             <condition value="search1">
               <set token="search_one"></set>
               <unset token="search_two"></unset>
             </condition>
             <condition value="search2">
               <unset token="search_one"></unset>
               <set token="search_two"></set>
             </condition>
           </change>
         </input>
       </fieldset>
       <row>
         <panel>    
           <chart  depends="$search_one$">
             <title>Search One</title>
             <search>
               <query>Query 1 | eval temp=$search_one$ | fields - temp</query>
               <earliest>-15m@m</earliest>
               <latest>now</latest>
             </search>
           </chart>
           <chart depends="$search_two$">
             <title>Search Two</title>
             <search>
               <query>Query 2 | eval temp=$search_two$ | fields - temp</query>
               <earliest>-1d@d</earliest>
               <latest>now</latest>
             </search>
           </chart>
         </panel>
       </row>
     </form>
0 Karma

lguinn2
Legend

Perhaps something like this would work for you. This defines a dashboard with one input. There are two charts, but only one chart appears. The chart that appears is based on the user input.

<form>
  <fieldset submitButton="false">
    <input type="radio" token="period_tok">
      <label>Select a time range</label>
      <choice value="search1">Search One Description</choice>
      <choice value="search2">Search Two Description</choice>
      <default>Search One Description</default>
      <change>
        <condition value="search1">
          <set token="show_searchOne">any value</set>
          <unset token="show_searchTwo"></unset>
        </condition>
        <condition value="search2">
          <unset token="show_searchOne"></unset>
          <set token="show_searchTwo">any value</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>    
      <chart  depends="$show_searchOne$">
        <title>Search One</title>
        <search>
          <query>index = _internal | timechart count by sourcetype</query>
          <earliest>-15m@m</earliest>
          <latest>now</latest>
        </search>
      </chart>
      <chart depends="$show_searchTwo$">
        <title>Search Two</title>
        <search>
          <query>index = _internal | timechart count by source</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
        </search>
      </chart>
    </panel>
  </row>
</form>

goyals05
Explorer

Thanks but my requirement is slightly different. In below example if value of LIVE_or_DROP is set then Query 1 should be run otherwise Query 2 should be run.

      <set token="LIVE_or_DROP">LIVE</set>



<query>Query 1</query>
      <earliest>abc</earliest>
      <latest>xyz</latest>
<finalized>
        <set token="x">$result.total$</set>



<query>Query 2</query>
      <earliest>abc</earliest>
      <latest>xyz</latest>
<finalized>
        <set token="x">$result.total$</set>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...