Splunk Search

Search based on two different dropdowns

martin61
Engager

I have two dropdowns.  I only want to run a single dropdown everytime for a search.

Closed Dropdown has token value as field1

OPEN Dropdown has token value as field4

In the dashboard's source, I have listed below query, so that the panel picks up the data as per input provided in dropdowm

index=*|lookup bar.csv IP OUTPUT BAR BAR_Status |search BAR="$field1$" OR BAR="$field4$"|chart count(IP) by BAR,STATUS

So If select closed dropdown the chart should provide the details only related to Closed and vice-versa. Please help.

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Reads like what you need is "AND" not "OR".  You want to give each dropdown token a default  value of "*", then use

index=*|lookup bar.csv IP OUTPUT BAR BAR_Status |search BAR="$field1$" AND BAR="$field4$"|chart count(IP) by BAR,STATUS

This way, the unselected dropdown will always result in a true condition. (You may also want to see if there is a different workflow for the dashboard to avoid two dropdowns for the same field.  Additionally, you want to give input tokens descriptive names.)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...