Splunk Search

is it possible to use tokens from 2 different files together in a query?

anooshac
Communicator

Hi all, i have been trying to use 2 tokens which are calculated from 2 different files in another query. But it is not working. Can i use 2 tokens from different files in one query or is there any alternative way to achieve this?

Tags (3)
0 Karma

sumanssah
Communicator

Yes, it's possible to use 2 tokens from 2 different searches into 1 search. Try using the below-mentioned sample dashboard and change variable as per requirement

<form theme="dark">
  <label>Host Login Details</label>
  <fieldset submitButton="false">
    <input type="time" token="timeFrame">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="field1" searchWhenChanged="true">
      <label>field1</label>
      <choice value="*">All</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>field1</fieldForLabel>
      <fieldForValue>field1</fieldForValue>
      <search>
        <query><your search1>| dedup field1 | table field1</query>
      </search>
    </input>
    <input type="dropdown" token="field2" searchWhenChanged="true">
      <label>field2</label>
      <choice value="*">all</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>field2</fieldForLabel>
      <fieldForValue>field2</fieldForValue>
      <search>
        <query><your search2>| dedup field2 | table field2</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query><your search> field1=$field1$ field2=$field2$ 

| table _time field1 field2</query>
          <earliest>$timeFrame.earliest$</earliest>
          <latest>$timeFrame.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

anooshac
Communicator

Hi @sumanssah thanks for responding! Actually i am getting the 2 tokens from 2 different files using query. And i am using both of them in the next query. But when both are being used together i am not getting any results. If anyone of them is used at a time i am getting a part of the output. do you know what will be the problem here?

0 Karma

harshpatel
Contributor

Please elaborate more on what you are trying to achieve.

0 Karma

anooshac
Communicator

hi @harshpatel , i have 2 tokens which are coming from 2 different json files. and i want to use them in the next query. But i am not able to do that. When i use both of them together i am not getting any results. Do you know if any solution for this!

0 Karma

harshpatel
Contributor

Did you check if the query generated after replacing both tokens has valid condition(which should satisfy the condition on event)?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...