Splunk Search

How to select specific fields conditionally based on user input for a drilldown search?

masumbuet
New Member

Hi,
I want to select fields conditionally based on user input. It is a drilldown search. I want to show specific fields based on the user click.

For example, I have the following fields:
Server Name
OS Version
OS Name
DB Name
DB Version

The main table contains OS, DB. If the user clicks OS, I need to show only the "OS Name", "OS Version" fields. How can I achieve this?

Your held is highly appreciated. Thanks in advance.

Tags (3)
0 Karma

ngatchasandra
Builder

If your main table contains OS and DB, this means that you have written a specific static request for this table that is going to displays only the OS and DB. Then, if you want this table change when you selected only OS, is not possible because your request is configured to displays always OS and DB.
We know that drilldown is launch when you click a value which is going to replace a token corresponding who is configured in search drilldown.
Thus, to do your work, you need to add other search (in other panel) which is going to interact with user input (dropdown input for example) then the click like this:
Index=”…..” OS= $OS$ | table “OS Name” “OS Version”

Dropown input can displays like this:

<input type="dropdown" token="OS" searchWhenChanged="true">
      <choice value="*">All</choice>
<populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="OS" fieldForValue="OS"> index=”…” | stats count by OS 
</populatingSearch
      <default>*</default>
      <prefix>OS="</prefix>
      <suffix>"</suffix>
    </input>
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...