Splunk Search

How to set up a drop-down box to represent 2 different variables at the same time (Multiple searches)?

lennys26
Communicator

I have a dashboard which takes user input from an input field ($number$) and then has a drop-down box for another option (inbound or outbound). The input is then searched in two different servers, each sever requiring a slightly different search string based on the drop-down choice.

The searches are run for either Inbound OR Outbound and on BOTH servers:

server 1: 
    If Inbound: index=direama Originating_Open_Digits_1=$number$ | .......
    If Outbound:    index=direama Terminating_Open_Digits_1=$number$ | .......

server 2: 
    If Inbound: index="genband-cdr" S3_called_party_ondest=$number$ | .......
    If Outbound:    index="genband-cdr" S3_ani=$number$ | .......

I was trying to use the drop-down box to represent the search string (Originating_Open_Digits_1, S3_called_party_ondest, etc), but this didn't work because I would have send a different strings for each server.

What I can't figure out is how to either:

  1. Get the variable to 'represent' 2 different search terms (or entire searches); OR
  2. The more ugly way to do it is to feed both terms into both searches and use an OR to get them to run.

Any ideas on how to set this up?

0 Karma

chimell
Motivator

Hi lennys26
Can you post me your dashboard xml code ?
i don't understand well your problem

0 Karma

stephanefotso
Motivator

I think the INPUT Multi-token Setter in dashboard 6.x example app should help you. Something like the one bellow. Take a look at it and let me know if you have any issue

<input type="dropdown" token="level">
        <label>Log Level:</label>
        <choice value="ANY">ANY</choice>
        <choice value="ERROR">ERROR</choice>
        <choice value="WARNING">WARNING</choice>
        <choice value="INFO">INFO</choice>
        <default>ANY</default>
        <change>
          <condition value="ANY">
            <set token="new_search">index=_internal sourcetype=splunkd | table _time sourcetype message</set>
          </condition>
          <condition value="*">
            <set token="new_search">index=_internal sourcetype=splunkd | table _time source sourcetype message</set>
          </condition>
        </change>
      </input>

      <table>
        <title></title>
        <search>
          <query>$new_search$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
      </table>
SGF
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...