Hi I'm new to Splunk and was wondering why this command does not work, and if there is a way to fix it. I would like to use a different string to search if $drop_name$ is equal to description. This is what I'm trying before but this search will not bring up any results.
| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | mvcombine sourcetype | table index sourcetype description | sort index | eval txt_name=if($drop_name$="desrciption", "$text_name$", "*$text_name$") | search $drop_name$=txt_name
Right now txt_name is the issue.
Here is also my xml code
Indexes and Sourcetypes
This dashboard is intended to show all of the Indexes and Sourcetypes in the Splunk environment.
The Indexes panel shows all of the indexes available for storing events.
The List of Sourcetypes by Index panel lists all the current sourcetypes, arranged by Index.
</html>
<table>
<title>Indexes</title>
<search>
<query>
| inputlookup index_lookup.csv | table index description
</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="count">100</option>
</table>
<panel>
<title>Search for Indexes and Sourcetypes</title>
<input type="text" token="text_name">
<default></default>
<label>User Search</label>
</input>
<input type="dropdown" token="drop_name">
<label>Search Choices</label>
<default>sourcetype</default>
<choice value="sourcetype">sourcetype</choice>
<choice value="index">index</choice>
<choice value="description">description</choice>
<showClearButton>false</showClearButton>
</input>
<html>
<button type="button">Search</button>
<button type="button">Reset</button>
</html>
</panel>
<table>
<title>List of Sourcetypes by Index</title>
<search>
<query>| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | mvcombine sourcetype | table index sourcetype description | sort index | eval txt_name=if("$drop_name$"=="description", "*$textname$*", "$text_name$*") | search $drop_name$=txt_name
</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="count">50</option>
</table>
... View more