Splunk Search

How to select specific fields conditionally based on user input for a drilldown search?

masumbuet
New Member

Hi,
I want to select fields conditionally based on user input. It is a drilldown search. I want to show specific fields based on the user click.

For example, I have the following fields:
Server Name
OS Version
OS Name
DB Name
DB Version

The main table contains OS, DB. If the user clicks OS, I need to show only the "OS Name", "OS Version" fields. How can I achieve this?

Your held is highly appreciated. Thanks in advance.

Tags (3)
0 Karma

ngatchasandra
Builder

If your main table contains OS and DB, this means that you have written a specific static request for this table that is going to displays only the OS and DB. Then, if you want this table change when you selected only OS, is not possible because your request is configured to displays always OS and DB.
We know that drilldown is launch when you click a value which is going to replace a token corresponding who is configured in search drilldown.
Thus, to do your work, you need to add other search (in other panel) which is going to interact with user input (dropdown input for example) then the click like this:
Index=”…..” OS= $OS$ | table “OS Name” “OS Version”

Dropown input can displays like this:

<input type="dropdown" token="OS" searchWhenChanged="true">
      <choice value="*">All</choice>
<populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="OS" fieldForValue="OS"> index=”…” | stats count by OS 
</populatingSearch
      <default>*</default>
      <prefix>OS="</prefix>
      <suffix>"</suffix>
    </input>
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...