Splunk Search

How to exclude condition from search depending on variable?

yurykiselev
Path Finder

Hi!

On my dashboard there is the dropdown list. I want to exlude its token criteria from search query if default value "notdef" is selected. i.e.:

if("$dropdown_token$" == "notdef")
    | WHERE param1 = $param1_token$ AND param2 = $param2_token$
else
    | WHERE param1 = $param1_token$ AND param2 = $param2_token$ AND dropdown_param = $dropdown_token$

I tried to use match replaceing "notdef" by empty sting while "notdef" is selected:

| eval dropdown_req = if("$dropdown_token$" == "notdef", "", "$dropdown_token$")
| WHERE param1 = $param1_token$ AND param2 = $param2_token$ AND match(dropdown_param, dropdown_req)

, but values of $dropdown_token$ include the sign "*" (e.g. "*A") and it doesn't work in regex in match().

Thank you!

0 Karma
1 Solution

niketn
Legend

You can create the where filter directly from change event of the dropdown using eval. I have given an example based on the details provided. Dropdown choice values might change as per your use case (I expected one of the choice values is notdef).

<input type="dropdown" token="dropdown_token" searchWhenChanged="true">
  <label>Select Field</label>
  <choice value="notdef">Not Defined</choice>
  <choice value="*">All</choice>
  <change>
    <eval token="filterQuery">if($value$=="notdef"," | WHERE param1=$param1_token$ AND param2=$param2_token$", " | WHERE param1=$param1_token$ AND param2=$param2_token$ AND dropdown_param = $value$")</eval>
  </change>
</input>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

yurykiselev
Path Finder

I solved this using token prefix-postfix:

  <prefix>| where dropdown_param = "</prefix>
  <suffix>"</suffix>

and blank as default value.

Thank you all!

0 Karma

niketn
Legend

You can create the where filter directly from change event of the dropdown using eval. I have given an example based on the details provided. Dropdown choice values might change as per your use case (I expected one of the choice values is notdef).

<input type="dropdown" token="dropdown_token" searchWhenChanged="true">
  <label>Select Field</label>
  <choice value="notdef">Not Defined</choice>
  <choice value="*">All</choice>
  <change>
    <eval token="filterQuery">if($value$=="notdef"," | WHERE param1=$param1_token$ AND param2=$param2_token$", " | WHERE param1=$param1_token$ AND param2=$param2_token$ AND dropdown_param = $value$")</eval>
  </change>
</input>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

dineshraj9
Builder

Can you try this way -

| eval flag=if(like("$dropdown_token$","notdef"),"*","$dropdown_token$") | search param1=$param1_token$ AND param2=$param2_token$ | where dropdown_param=flag
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...