Splunk Search

How to build a dashboard multitoken using another token?

fooflington
New Member

I would like to build a dashboard token using a combination of a dropdown field and a checkbox field to build a host selector based on various components of the hostname (which follows a predefined syntax: service-environment-role-NNN)

I tried doing this as:

  • Dropdown for environment: [ A | B ]
  • Checkbox for role: [ X | Y | Z ]

The token settings for $role$ I set as:

  • Token prefix: (
  • Token suffix: )
  • Token value prefix: host=service-$environment$-
  • Token value suffix: -*
  • Delimiter: OR

This seemed to do the right thing until I tried changing the Environment dropdown and nothing changed. It turned out that, when clicking Apply when setting the above, the $environment$ value was being baked into the Token value prefix setting and couldn't be changed.

Given that I would like multiple roles to be selectable in this dashboard, is there a way to construct this search filter either declaratively in the GUI or as part of the canned search?

Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...