Splunk Search

How to use N values in a search dependent on a user selecting N values from drop-down forms?

smhsplunk
Communicator

I have 9 drop-downs, and depending on user selection, the search is going to use those values to create a table. Since the drop-down values are dynamically generated (each is linked to another), there is no way to know how many of the values will be used in the final search. I want to know how is it possible to use N values in a search dependent on a user selecting N values.

source=main sourcetype=traffic_information 
| search * traffic_location $imd1$ $imd2$ $imd3$ $imd4$ $imd5$ $imd6$ $imd7$ $imd8$ imd9$ 
| table city, state, location

Is it possible to have a default value (or just don't use) in the above search when the value is not selected?

Thanks

0 Karma
1 Solution

sundareshr
Legend

You can set the default to * in the drop-down. In addition to the query to populate dropdown with dynamic values, you can add static values. A common use for static values is to add "*" and set that to be the default.

View solution in original post

sundareshr
Legend

You can set the default to * in the drop-down. In addition to the query to populate dropdown with dynamic values, you can add static values. A common use for static values is to add "*" and set that to be the default.

smhsplunk
Communicator

Thanks! This works fine.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...