Dashboards & Visualizations

how to remove where clause based on search input

merc14
Explorer

I have a search query that takes a search value from a drop down. 

Example

Drop down has values

All

A

B

Query uses 

| where productType="$dropdown$"

How do I remove the where clause if All is selected. There is no productType - All

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

merc14
Explorer

Thank you very much, replaced where with search and that worked like a charm

gcusello
SplunkTrust
SplunkTrust

Hi @merc14,

probably you're meaning that you could have events without the productType, obviously these events aren't matched by the All (*) value.

You could modify the input adding an additiona static value to search the events without productType.

If you could share the input code, I can be more detailed.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can't remove code from SPL based on input.  Nor does SPL allow for conditional execution.  The solution is to set the "All" value of $dropdown$ to a value that is valid for all productType values.  Often, this is "*".  It may be necessary to change where to search.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...