Splunk Search

How to select specific fields conditionally based on user input for a drilldown search?

masumbuet
New Member

Hi,
I want to select fields conditionally based on user input. It is a drilldown search. I want to show specific fields based on the user click.

For example, I have the following fields:
Server Name
OS Version
OS Name
DB Name
DB Version

The main table contains OS, DB. If the user clicks OS, I need to show only the "OS Name", "OS Version" fields. How can I achieve this?

Your held is highly appreciated. Thanks in advance.

Tags (3)
0 Karma

ngatchasandra
Builder

If your main table contains OS and DB, this means that you have written a specific static request for this table that is going to displays only the OS and DB. Then, if you want this table change when you selected only OS, is not possible because your request is configured to displays always OS and DB.
We know that drilldown is launch when you click a value which is going to replace a token corresponding who is configured in search drilldown.
Thus, to do your work, you need to add other search (in other panel) which is going to interact with user input (dropdown input for example) then the click like this:
Index=”…..” OS= $OS$ | table “OS Name” “OS Version”

Dropown input can displays like this:

<input type="dropdown" token="OS" searchWhenChanged="true">
      <choice value="*">All</choice>
<populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="OS" fieldForValue="OS"> index=”…” | stats count by OS 
</populatingSearch
      <default>*</default>
      <prefix>OS="</prefix>
      <suffix>"</suffix>
    </input>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...