Dashboards & Visualizations

where to add token in my search string which is a join of two indexes

radha116
Explorer

I have a query as below 

 

I have a table with below search string:

index="apple" | table "ID"
| join type=left ID [search index="csv"] | table  "ID" "Type" "Status"
** Type is in csv index table

created a dropdown for type with token = type_filter. 

On the above search string where should I include the token to function my dropdown.

 

 

 

Labels (1)
0 Karma
1 Solution

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

View solution in original post

0 Karma

radha116
Explorer

Type dropdown has options fruits, vegetables. When i select fruits i want to see the table filtered with Type: fruit.

 

index="apple" | table "ID"
| join type=left ID [search index="csv"  "$type_filter$"] | table  "ID" "Type" "Status"

is the above correct

Tags (1)
0 Karma

radha116
Explorer

resolved 

 

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table  "ID" "Type" "Status" | search Type="$type_filter$"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to exclude with the token. Do you want IDs from apple with data from csv regardless of whether they have a match to the token in csv or do you want to exclude IDs from apple if they have a match to the token in a field from csv?

If you want the first case you would put the exclusion inside the join search, if you want the second case you would put the exclusion outside / after the join search.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...