Search parameter changed, need help with query

[jiaqya]

i have a search parameter for ex : search Data="Test". This data is there in the index and it has daily ingest and it has daily _time.

This Data field is a filter , which i select and then it shows me all the data with Data="Test" via drilldown token.
Now this field has changed to "NoTest"

now when i choose from drilldown, i see "NoTest" instead of "Test".
if i choose "NoTest", all previous data is not showing as they all have Data="Test": ( this table has historical data so i need to show both )

i need a way to show both "NoTest" and "Test" without changing much of query ( as other filters are unchanged, only this one has changed )

[woodcock]

Show us your XML.

[jiaqya]

i will not be able to share the query , but i found a way around it, i was able to eval and replace the old value with new value so that it works fine now, its a bit slow , but does the job...

[_gkollias]

I assume you're working with dashboards here? Without seeing the source code, it's hard to say what the root cause is. Can you provide the Simple XML and a dummy of the example search that you're using?

These docs may be helpful in your case:

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/tokens
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/FormEditor

Also, I recommend downloading the Dashboard Examples app from Splunkbase where you can copy example source code for dropdown inputs (and more!):

https://splunkbase.splunk.com/app/1603/

[to4kawa]

use base search
see

https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/Savedsearches

https://answers.splunk.com/answers/239159/multiple-base-searches-in-a-dasboard-with-post-pro.html