Splunk Search

How to create dashboard filters with lookups?

Path Finder

Hello,

I am trying to create dashboard filters (multiselect) using a lookup. The filters I am trying to add to my report are region,country, and location. The location field exists in my event data and I want to match that location on the servicereceiptlocation of my lookup to pull in region, country, and location and filter on those. I am having some problems figuring out how to do that in my search query. I have the drop down filters working correctly. Below is the HTML code for the filters. Can you please help me figure out how to put these in my search? Thank you!

<input type="multiselect" searchWhenChanged="true" token="region">
  <label>Region</label>
  <prefix>(</prefix>
  <suffix>)</suffix>
  <valuePrefix>Region="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <search>
    <query>| inputlookup CallCenterSites.csv | stats count by Region</query>
  </search>
  <fieldForLabel>Region</fieldForLabel>
  <fieldForValue>Region</fieldForValue>
  <choice value="*&quot; OR NOT Region= &quot;*">All</choice>
  <default>"*"" OR NOT Region= ""*"</default>
</input>
<input type="multiselect" searchWhenChanged="true" token="country">
  <label>Country</label>
  <prefix>(</prefix>
  <suffix>)</suffix>
  <valuePrefix>Country="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <choice value="*&quot; OR NOT Country=&quot;*">All</choice>
  <search>
    <query>| inputlookup CallCenterSites.csv | search $region$ | stats count by Country</query>
    <earliest>-30d@d</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>Country</fieldForLabel>
  <fieldForValue>Country</fieldForValue>
  <default>"*"" OR NOT Country=""*"</default>
</input>
<input type="multiselect" searchWhenChanged="true" token="loc">
  <label>Location</label>
  <prefix>(</prefix>
  <suffix>)</suffix>
  <valuePrefix>Service_Recipient_Location="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <choice value="*&quot; OR NOT Service_Recipient_Location=&quot;*">All</choice>
  <search>
    <query>|inputlookup CallCenterSites.csv| search $country$ | stats count by Service_Recipient_Location</query>
    <earliest>0</earliest>
  </search>
  <fieldForLabel>Service_Recipient_Location</fieldForLabel>
  <fieldForValue>Service_Recipient_Location</fieldForValue>
  <default>"*"" OR NOT Service_Recipient_Location=""*"</default>
</input>
0 Karma

Hey,
If your raw data contains a field ServiceRecipientLocation and you want to apply all filters than you can write the query like:

index=foo sourcetype=bar $region$ $country$ $loc$

0 Karma

SplunkTrust
SplunkTrust

If your raw data contains field called (same case) Service_Recipient_Location then your search can be like this

index=foo sourcetype=bar $loc$

If the field name is different, you'd need to rename the field in dropdown 3 for Location (rename at the end of search, update fieldForValue/fieldForLabel/default/choice/prefix etc with appropriate fieldname)

0 Karma

Path Finder

okay I changed the lookup to be named location but that doesn't help me filter on region or country- only on location

0 Karma