Splunk Search

How to exclude condition from search depending on variable?

yurykiselev
Path Finder

Hi!

On my dashboard there is the dropdown list. I want to exlude its token criteria from search query if default value "notdef" is selected. i.e.:

if("$dropdown_token$" == "notdef")
    | WHERE param1 = $param1_token$ AND param2 = $param2_token$
else
    | WHERE param1 = $param1_token$ AND param2 = $param2_token$ AND dropdown_param = $dropdown_token$

I tried to use match replaceing "notdef" by empty sting while "notdef" is selected:

| eval dropdown_req = if("$dropdown_token$" == "notdef", "", "$dropdown_token$")
| WHERE param1 = $param1_token$ AND param2 = $param2_token$ AND match(dropdown_param, dropdown_req)

, but values of $dropdown_token$ include the sign "*" (e.g. "*A") and it doesn't work in regex in match().

Thank you!

0 Karma
1 Solution

niketn
Legend

You can create the where filter directly from change event of the dropdown using eval. I have given an example based on the details provided. Dropdown choice values might change as per your use case (I expected one of the choice values is notdef).

<input type="dropdown" token="dropdown_token" searchWhenChanged="true">
  <label>Select Field</label>
  <choice value="notdef">Not Defined</choice>
  <choice value="*">All</choice>
  <change>
    <eval token="filterQuery">if($value$=="notdef"," | WHERE param1=$param1_token$ AND param2=$param2_token$", " | WHERE param1=$param1_token$ AND param2=$param2_token$ AND dropdown_param = $value$")</eval>
  </change>
</input>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

yurykiselev
Path Finder

I solved this using token prefix-postfix:

  <prefix>| where dropdown_param = "</prefix>
  <suffix>"</suffix>

and blank as default value.

Thank you all!

0 Karma

niketn
Legend

You can create the where filter directly from change event of the dropdown using eval. I have given an example based on the details provided. Dropdown choice values might change as per your use case (I expected one of the choice values is notdef).

<input type="dropdown" token="dropdown_token" searchWhenChanged="true">
  <label>Select Field</label>
  <choice value="notdef">Not Defined</choice>
  <choice value="*">All</choice>
  <change>
    <eval token="filterQuery">if($value$=="notdef"," | WHERE param1=$param1_token$ AND param2=$param2_token$", " | WHERE param1=$param1_token$ AND param2=$param2_token$ AND dropdown_param = $value$")</eval>
  </change>
</input>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

dineshraj9
Builder

Can you try this way -

| eval flag=if(like("$dropdown_token$","notdef"),"*","$dropdown_token$") | search param1=$param1_token$ AND param2=$param2_token$ | where dropdown_param=flag
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...