Splunk Search

Using search keyword or where keyword

nirmalya2006
Path Finder

Hi All

I have data in the below fomat

Country={UK}, Question=Where do you live, Answer=London 
Country={USA}, Question=Where do you live, Answer=New York 
Country={UK}, Question=What is you pet, Answer=dog 
Country={USA}, Question=What is you pet, Answer=cat

... and so on

I have a drop down in my dashboard that selects the market.
I have a static option 'All' with value as *.
But using the * my below query breaks.

| index=myindex
| where Country="{"."$country$"."}"
| table Country, Question, Answer

When I select any specific country it works, but it breaks when I select the All option
I found by trial and error that I have to use search keyword instead of where when it comes to use asterisk *.
But search key word doesn't go with the expression that I am using, so I have to use where.

I am confused as to which keyword to use or is there any other way I can do it.
Can someone help with some guidance.

Thanks

Tags (1)
0 Karma

HiroshiSatoh
Champion

I think that I should use the search command.

| search Country="{$country$}"

$country$=*,UK,USA
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...