Splunk Search

How to build a query from 2 different multivalue inputs


I have a bunch of indexes in the format of <environment>-<machineType>

This is something like test-manager, staging-manager, staging-client

I would like to build a dashboard where the user can select 2 different multi-value inputs, one for the environment and another for the machine type which would then reflect on the graphs themselves.

I can build a dynamic multi-valued input for environment using a query like

| eventcount summarize=false index="*" | rex field=index "(?<environment>.*?)-.*?$" | dedup environment | fields environment

or just a static one, doesn't matter much.

What I am having a hard time with is how do I join the user selections into a search?

An example would be the user selects test and qa for environment and then selects manager for machine type and I am looking for the query to contain something like

index="test-manager" OR index="qa-manager"

How would one go about this?

Tags (2)
0 Karma



You can try using token prefix and token suffixes as token itself.
For eg. for environment , token suffix will be -$machinetype$ and for machinetype token prefix will be -$environment$.

Hope this helps!!!!!!!

0 Karma


There are many ways. Probably the easiest, if the words are all distinct on both sides, is to just have each side wildcarded so that...

(index="test-*" OR index="staging-*" ...) AND (index="*-manager" OR  index="*-client"... )
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...