Dashboards & Visualizations

where to add token in my search string which is a join of two indexes

radha116
Explorer

I have a query as below 

 

I have a table with below search string:

index="apple" | table "ID"
| join type=left ID [search index="csv"] | table  "ID" "Type" "Status"
** Type is in csv index table

created a dropdown for type with token = type_filter. 

On the above search string where should I include the token to function my dropdown.

 

 

 

Labels (1)
0 Karma
1 Solution

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

View solution in original post

0 Karma

radha116
Explorer

Type dropdown has options fruits, vegetables. When i select fruits i want to see the table filtered with Type: fruit.

 

index="apple" | table "ID"
| join type=left ID [search index="csv"  "$type_filter$"] | table  "ID" "Type" "Status"

is the above correct

Tags (1)
0 Karma

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to exclude with the token. Do you want IDs from apple with data from csv regardless of whether they have a match to the token in csv or do you want to exclude IDs from apple if they have a match to the token in a field from csv?

If you want the first case you would put the exclusion inside the join search, if you want the second case you would put the exclusion outside / after the join search.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...