Splunk Search

How to modify a part of a search based on two inputs selection?

ktn01
Path Finder

Hello,
I have a dashboard with 2 inputs:

  • A radio input with two buttons, index and role, with the token view
  • Text input with the token filter

And a table with the result of a search.

I want to set the end off my search depending the values of $view$ and $filter$

I should have " | search index_name=*$filter$* | stats values(Role) by index_name " if $view$ is index
or " | search Role=*$filter$* | stats values(index_name) by Role " if $view$ is role

Any idee how to do this?

Thanks

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You can set new tokens( which will be used in search) based on the value selected in the radio button. See the example in following Splunk documentation:
https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/PanelreferenceforSimplifiedXML#condition_.28f...

View solution in original post

somesoni2
Revered Legend

You can set new tokens( which will be used in search) based on the value selected in the radio button. See the example in following Splunk documentation:
https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/PanelreferenceforSimplifiedXML#condition_.28f...

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...