Activity Feed
- Posted Re: How can we run searches based on token value? on Splunk Search. 07-27-2017 11:11 AM
Topics I've Started
No posts to display.
07-27-2017
11:11 AM
An easy solution is to actually use the tokens that are created from a conditional statement on the dropdown menu within the actual search. These value and field is then immediately removed from the results. This works as the search will not run until the all tokens present within the search are set.
<form>
<fieldset submitButton="false">
<input type="radio" token="sample_radio">
<label>Select which search</label>
<choice value="search1">search 1</choice>
<choice value="search2">search 2</choice>
<default></default>
<change>
<condition value="search1">
<set token="search_one"></set>
<unset token="search_two"></unset>
</condition>
<condition value="search2">
<unset token="search_one"></unset>
<set token="search_two"></set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<chart depends="$search_one$">
<title>Search One</title>
<search>
<query>Query 1 | eval temp=$search_one$ | fields - temp</query>
<earliest>-15m@m</earliest>
<latest>now</latest>
</search>
</chart>
<chart depends="$search_two$">
<title>Search Two</title>
<search>
<query>Query 2 | eval temp=$search_two$ | fields - temp</query>
<earliest>-1d@d</earliest>
<latest>now</latest>
</search>
</chart>
</panel>
</row>
</form>
... View more