Splunk Search

How do I pass an input parameter to the search string of another input?

srizan
Path Finder

I have multiple inputs in the dashboard. The first input is for various environments (hard coded). And the second input is for various accounts from the selected environment (leverages search string). I have the first input tokenized as "env" however, passing it in the second input search string as environment=$env$ doesn't yield the value from the first input.

Tags (2)
0 Karma

srizan
Path Finder

Yeah! Seems like there was some issue with caching maybe, it worked in incognito.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @srizan,
searches are the same in inputs and panels, so you can manage tokens in the same way.
check if you need quotes because $env$ could contain spaces:

environment="$env$"

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @srizan,
what do you mean with " it worked in incognito."?
Did you solved?

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...