Splunk Search

Field in Lookup Table with Multiple Values

alan20854
Path Finder

In one of the columns of my lookup table, host, some values have two hosts rather than just one.

For example, my table might look like this
app,environment,host
app1,env1,host1
app1,env2,host1 OR host2
...

In my dashboard panel, I am writing a query that would search for all events with the selected environment and host. However, for the ones with two hosts, the search query only searches for the first host. How would I be able to search for both?

Tags (3)
0 Karma
1 Solution

sundareshr
Legend

You can use dynamic tokens. Something like this

<input type=dropdown>
<change>
<eval token="hosts">replace($value$, " OR ", " OR host=")</eval>

View solution in original post

jbillings
SplunkTrust
SplunkTrust

Way late to the game, but for anyone that is looking for something like this, you may try insert this in your search. It will make the host field multivalue based on the comma.
| inputlookup
| makemv delim="," host

0 Karma

sundareshr
Legend

You can use dynamic tokens. Something like this

<input type=dropdown>
<change>
<eval token="hosts">replace($value$, " OR ", " OR host=")</eval>

alan20854
Path Finder

Would this be the same for if I just had static options in my dropdown?

0 Karma

alan20854
Path Finder

I tried to do what you suggested, but it didn't seem to change my search query when I opened it up in search. Here is the XML:

  <input type="dropdown" token="env" searchWhenChanged="true">
  <label>Environment</label>
  <choice value="host1 OR host2 OR host3">PROD</choice>
  <choice value="host1 OR host4">QA</choice>
  <choice value="host5">QI1</choice>
  <choice value="host5 OR host6">QI2</choice>
  <choice value="host7">QC1</choice>
  <change>
    <eval token="hosts">replace($value$, " OR ", " OR host=")</eval>
  </change>
</input>
0 Karma

sundareshr
Legend

If these are static values, your best option would be change the values to

   <choice value="host=host1 OR host=host2 OR host=host3">PROD</choice>
   <choice value="host=host1 OR host=host4">QA</choice>
   <choice value="host=host5">QI1</choice>
   <choice value="host=host5 OR host=host6">QI2</choice>
   <choice value="host=host7">QC1</choice>

If these are dynamically populated, you could add the host= in the query that is populating the dropdown.

The other option is to use tags in your data and in the dropdowns
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Defineandusetags

0 Karma

alan20854
Path Finder

Thanks for the help!

0 Karma

alan20854
Path Finder

And my search query is: host = $env$ ...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you have control over the lookup table, consider a separate row for the extra host.

app,environment,host
app1,env1,host1
app1,env2,host1
app1,env2,host2
---
If this reply helps you, Karma would be appreciated.

alan20854
Path Finder

Hi Rich,

I am using the lookup table to populate my dropdowns, but I do not want to create another dropdown for host. Is there a way to search for both hosts now that they are in separate rows?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I didn't get the part where you were populating a dropdown. This answer won't help with that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...