Splunk Search

Is there a way to display a different name in a drop-down list, but use the original string value in the search using the chart replace function?

sreelesh_n
New Member

Hi

I have a drop-down and Chart/List. The chart should show the event on the item selected from list.

Is there a way display the ProcessContext_ProjectName in the drop-down list removing Java, but while searching, it should use original string?
The replace function is working replace "Java*" with "*" IN ProcessContext_ProjectName, but while doing the search below on another chart from token_projectname2 , it should pick up from the original string including Java.
Right now, the chart is always giving a blank result if I do a filter by Replace.

<input type="dropdown" token="token_projectname2" searchWhenChanged="true">
      <search>
        <query>index=u2 sourcetype=jms_body_header_txt     | dedup   ProcessContext_ProjectName | table ProcessContext_ProjectName</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <fieldForLabel>ProcessContext_ProjectName</fieldForLabel>
      <fieldForValue>ProcessContext_ProjectName</fieldForValue>
    </input>
0 Karma

gyslainlatsa
Motivator

hi sreelesh_n,

try to write like this: replace "Java *" WITH "*" IN ProcessContext_ProjectName

if that does not work, please me you post your entire code and then I can look at the problem.

0 Karma

sundareshr
Legend

The dropdown takes two parameters Name field and Value field. You could add a field for the name like | eval name_field=replace(ProcessContext_ProjectName, "Java*", "*") and then in the dropdown, use the name_field for the fieldForLabel and set value field as ProcessContext_ProjectName.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...