Splunk Search

Search based on two different dropdowns

martin61
Engager

I have two dropdowns.  I only want to run a single dropdown everytime for a search.

Closed Dropdown has token value as field1

OPEN Dropdown has token value as field4

In the dashboard's source, I have listed below query, so that the panel picks up the data as per input provided in dropdowm

index=*|lookup bar.csv IP OUTPUT BAR BAR_Status |search BAR="$field1$" OR BAR="$field4$"|chart count(IP) by BAR,STATUS

So If select closed dropdown the chart should provide the details only related to Closed and vice-versa. Please help.

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Reads like what you need is "AND" not "OR".  You want to give each dropdown token a default  value of "*", then use

index=*|lookup bar.csv IP OUTPUT BAR BAR_Status |search BAR="$field1$" AND BAR="$field4$"|chart count(IP) by BAR,STATUS

This way, the unselected dropdown will always result in a true condition. (You may also want to see if there is a different workflow for the dashboard to avoid two dropdowns for the same field.  Additionally, you want to give input tokens descriptive names.)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...