×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
rwheeloc
Explorer
Member since: ‎11-19-2024
‎03-27-2025
Community Statistics
Posts 5
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎11-19-2024
Activity Feed
View All

Re: How to append domain to hostname at search tim...

by in Splunk Search
‎03-28-2025 09:53 AM
‎03-28-2025 09:53 AM
Thank you very much! I think I've got it working as intended now! ... View more

Re: How to append domain to hostname at search tim...

by in Splunk Search
‎03-27-2025 12:36 PM
‎03-27-2025 12:36 PM
Thanks! This is using Dashboard Studio. The input is currently via a multiselect dropdown. Ultimately the goal of this dashboard is for the user to be able to select one or more values from the dropdown, and be presented with corresponding results from queries to two separate indices. The challenge is that one index has hostnames stored as fqdn, and the other the host by itself.   I've also wondered if it might be a better approach for the drop-down values to include the domain, and then somehow strip it back out in the query against the index that doesn't need it?   ... View more

How to append domain to hostname at search time?

by in Splunk Search
‎03-27-2025 11:35 AM
‎03-27-2025 11:35 AM
I've done a bit of searching and haven't quite found a solution to what I'm trying to accomplish (or I haven't understood the previous solutions). But essentially I'm trying to write an SPL query (for use in a dashboard) that will append a string (domain) to a list of values (hosts) passed by a token prior to processing the search. For example, if the value passed by token $DeviceNames$ is "host1,host2,host3", the goal would be to return results as if the query was equivalent to: hostname IN (host1.domain.com,host2.domain.com,host3.domain.com)   ... View more
Labels

Re: Search query within IF statement?

by in Dashboards & Visualizations
‎11-19-2024 12:49 PM
‎11-19-2024 12:49 PM
Thank you! I'm working on reproducing this in json format for Dashboard Studio, and keep getting an error that the input myast have a 'type' specified... any guidance on what that would need to be?   ... View more

Search query within IF statement?

by in Dashboards & Visualizations
‎11-19-2024 07:55 AM
‎11-19-2024 07:55 AM
I'm trying to come up with a search query that ignores parameters if left blank, but ignores other parameters if filled in. In this case, "-" is the default value for token1 and token2. If token1 and token2 are left at this default, I want to find results based only on token3; but if token1 or token2 are specified then I want token3 to be disregarded.   Here's what I've been trying, but so far doesn't seem to be working as I'd hoped: if(($token1$ == "-" AND $token2$ =="-"), (search Field3=$token3$), (search Field1="$token1$" OR Field2="$token2$")) Am I on the right track? Something I'm missing? ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-27-2025 06:29 PM
Karma given to
View All