Splunk Search

How to select specific fields conditionally based on user input for a drilldown search?

masumbuet
New Member

Hi,
I want to select fields conditionally based on user input. It is a drilldown search. I want to show specific fields based on the user click.

For example, I have the following fields:
Server Name
OS Version
OS Name
DB Name
DB Version

The main table contains OS, DB. If the user clicks OS, I need to show only the "OS Name", "OS Version" fields. How can I achieve this?

Your held is highly appreciated. Thanks in advance.

Tags (3)
0 Karma

ngatchasandra
Builder

If your main table contains OS and DB, this means that you have written a specific static request for this table that is going to displays only the OS and DB. Then, if you want this table change when you selected only OS, is not possible because your request is configured to displays always OS and DB.
We know that drilldown is launch when you click a value which is going to replace a token corresponding who is configured in search drilldown.
Thus, to do your work, you need to add other search (in other panel) which is going to interact with user input (dropdown input for example) then the click like this:
Index=”…..” OS= $OS$ | table “OS Name” “OS Version”

Dropown input can displays like this:

<input type="dropdown" token="OS" searchWhenChanged="true">
      <choice value="*">All</choice>
<populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="OS" fieldForValue="OS"> index=”…” | stats count by OS 
</populatingSearch
      <default>*</default>
      <prefix>OS="</prefix>
      <suffix>"</suffix>
    </input>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...