Splunk Search

How to use N values in a search dependent on a user selecting N values from drop-down forms?

smhsplunk
Communicator

I have 9 drop-downs, and depending on user selection, the search is going to use those values to create a table. Since the drop-down values are dynamically generated (each is linked to another), there is no way to know how many of the values will be used in the final search. I want to know how is it possible to use N values in a search dependent on a user selecting N values.

source=main sourcetype=traffic_information 
| search * traffic_location $imd1$ $imd2$ $imd3$ $imd4$ $imd5$ $imd6$ $imd7$ $imd8$ imd9$ 
| table city, state, location

Is it possible to have a default value (or just don't use) in the above search when the value is not selected?

Thanks

0 Karma
1 Solution

sundareshr
Legend

You can set the default to * in the drop-down. In addition to the query to populate dropdown with dynamic values, you can add static values. A common use for static values is to add "*" and set that to be the default.

View solution in original post

sundareshr
Legend

You can set the default to * in the drop-down. In addition to the query to populate dropdown with dynamic values, you can add static values. A common use for static values is to add "*" and set that to be the default.

smhsplunk
Communicator

Thanks! This works fine.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...