Dashboards & Visualizations

where to add token in my search string which is a join of two indexes

radha116
Explorer

I have a query as below 

 

I have a table with below search string:

index="apple" | table "ID"
| join type=left ID [search index="csv"] | table  "ID" "Type" "Status"
** Type is in csv index table

created a dropdown for type with token = type_filter. 

On the above search string where should I include the token to function my dropdown.

 

 

 

Labels (1)
0 Karma
1 Solution

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

View solution in original post

0 Karma

radha116
Explorer

Type dropdown has options fruits, vegetables. When i select fruits i want to see the table filtered with Type: fruit.

 

index="apple" | table "ID"
| join type=left ID [search index="csv"  "$type_filter$"] | table  "ID" "Type" "Status"

is the above correct

Tags (1)
0 Karma

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to exclude with the token. Do you want IDs from apple with data from csv regardless of whether they have a match to the token in csv or do you want to exclude IDs from apple if they have a match to the token in a field from csv?

If you want the first case you would put the exclusion inside the join search, if you want the second case you would put the exclusion outside / after the join search.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...