Splunk Search

Is there a way to display a different name in a drop-down list, but use the original string value in the search using the chart replace function?

sreelesh_n
New Member

Hi

I have a drop-down and Chart/List. The chart should show the event on the item selected from list.

Is there a way display the ProcessContext_ProjectName in the drop-down list removing Java, but while searching, it should use original string?
The replace function is working replace "Java*" with "*" IN ProcessContext_ProjectName, but while doing the search below on another chart from token_projectname2 , it should pick up from the original string including Java.
Right now, the chart is always giving a blank result if I do a filter by Replace.

<input type="dropdown" token="token_projectname2" searchWhenChanged="true">
      <search>
        <query>index=u2 sourcetype=jms_body_header_txt     | dedup   ProcessContext_ProjectName | table ProcessContext_ProjectName</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <fieldForLabel>ProcessContext_ProjectName</fieldForLabel>
      <fieldForValue>ProcessContext_ProjectName</fieldForValue>
    </input>
0 Karma

gyslainlatsa
Motivator

hi sreelesh_n,

try to write like this: replace "Java *" WITH "*" IN ProcessContext_ProjectName

if that does not work, please me you post your entire code and then I can look at the problem.

0 Karma

sundareshr
Legend

The dropdown takes two parameters Name field and Value field. You could add a field for the name like | eval name_field=replace(ProcessContext_ProjectName, "Java*", "*") and then in the dropdown, use the name_field for the fieldForLabel and set value field as ProcessContext_ProjectName.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...