Splunk Search

How to use N values in a search dependent on a user selecting N values from drop-down forms?

smhsplunk
Communicator

I have 9 drop-downs, and depending on user selection, the search is going to use those values to create a table. Since the drop-down values are dynamically generated (each is linked to another), there is no way to know how many of the values will be used in the final search. I want to know how is it possible to use N values in a search dependent on a user selecting N values.

source=main sourcetype=traffic_information 
| search * traffic_location $imd1$ $imd2$ $imd3$ $imd4$ $imd5$ $imd6$ $imd7$ $imd8$ imd9$ 
| table city, state, location

Is it possible to have a default value (or just don't use) in the above search when the value is not selected?

Thanks

0 Karma
1 Solution

sundareshr
Legend

You can set the default to * in the drop-down. In addition to the query to populate dropdown with dynamic values, you can add static values. A common use for static values is to add "*" and set that to be the default.

View solution in original post

sundareshr
Legend

You can set the default to * in the drop-down. In addition to the query to populate dropdown with dynamic values, you can add static values. A common use for static values is to add "*" and set that to be the default.

smhsplunk
Communicator

Thanks! This works fine.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...