How to search based on variable? | search no = variable

[LearningGuy]

Hello,

How to search based on variable?   


If select contains "many", then search no IN (1 to 30),  else search NO 7

| eval  variable = if(select="many", "(1-30)", "7") 

| search no IN variable             ==>    This doesn't work

| search no IN (7)     ==>    This works

| search no IN (1,2,3,4,5,6,7,8,9,10,11)   ==>    This works,   but I have to manually put the number

| where variable IN (1,2,3,4,5,6,7,8,9,10,11) ==>    This  does not work ( although the Splunk documentation said it should work) https://docs.splunk.com/Documentation/SCS/current/SearchReference/WhereCommandOverview

| regex no= "([1-30])"   ==>   This works   

| regex no = variable   ==>   This does not work   (variable)

Thank you for your help

[LearningGuy]

Hello,
I need to filter using search based on a condition
instead of  | search no = "abc"         I need to make  "abc" as a variable

Thanks,

Marius

[isoutamo]

You didn't tell what is your issue. You just told how you are trying to solve it! In splunk there are usually several ways to solve those and some are much better that other. Usually people whom are not familiar with splunk try to use the second option ....

You can see e.g. https://community.splunk.com/t5/Splunk-Search/How-to-return-a-single-value-from-a-subsearch-into-eva... how to use "variables" on search etc.

[LearningGuy]

Thanks for your suggestion
I tried to simplify, but this is what I am trying to solve:

https://community.splunk.com/t5/Splunk-Search/How-to-search-based-on-drop-down-condition/m-p/681366#...

[isoutamo]

Again you just told how you are trying to solve something, but you didn't tell what is your real issue?

Could you describe what you are looking with this dashboard? 

[isoutamo]

Hi

as you can see this depends on case. You must also understand that SPL is not a programming language and for that reason it works differently than those.

What is your use case / issue which you are trying to solve?

r. Ismo