Splunk Search

Can a variable value which depends on a dropdown token be included in search?

efranke
New Member

Hello everyone,

I am trying to assign a value to "myVar", which depends on a dropdown token on my dashboard. The value of "myVar" is used to search for a specific sourcetype. This is my current solution which does not work:

index="dev_analytics" OR index="live_analytics" | 
eval myVar=case($instance$==servertoserver-test,"flink_dev2",$instance$==servertoserver-prod,"s2sdatacollector") | 
where sourcetype==myVar

It works, if I just assign the specific value to "myVar" (eval myVar=="mySourcetype"). For specifc reasons, I can not do something like sourcetype=$instance$.

Is there anything I can do to make my solution work?

Thanks in advance and regards,
Eric

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@efranke ,

Set the value at the dropdown on change event.

Here is an example

<form>
  <label>efranke</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="instance">
      <label>Instance</label>
      <choice value="servertoserver-test">servertoserver-test</choice>
      <choice value="servertoserver-prod">servertoserver-prod</choice>
      <default>servertoserver-test</default>
      <initialValue>servertoserver-test</initialValue>
      <change>
        <condition value="servertoserver-test">
          <set token="sourcetype">flink_dev2</set>
        </condition>
        <condition value="servertoserver-prod">
          <set token="sourcetype">s2sdatacollector</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Result for $sourcetype$</title>
      <table>
        <search>
          <query>index="dev_analytics" OR index="live_analytics" sourcetype="$sourcetype$"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

0 Karma

efranke
New Member

@renjith.nair

Thank you, the solution works perfectly for me.

Regards,
Eric

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@efranke ,

Set the value at the dropdown on change event.

Here is an example

<form>
  <label>efranke</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="instance">
      <label>Instance</label>
      <choice value="servertoserver-test">servertoserver-test</choice>
      <choice value="servertoserver-prod">servertoserver-prod</choice>
      <default>servertoserver-test</default>
      <initialValue>servertoserver-test</initialValue>
      <change>
        <condition value="servertoserver-test">
          <set token="sourcetype">flink_dev2</set>
        </condition>
        <condition value="servertoserver-prod">
          <set token="sourcetype">s2sdatacollector</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Result for $sourcetype$</title>
      <table>
        <search>
          <query>index="dev_analytics" OR index="live_analytics" sourcetype="$sourcetype$"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...