Dashboards & Visualizations

Complete search string based on a drop down

nebel
Communicator

Hi,

lets say I have a drop down with "red" and "green".
If I choose red the search should look like:

index=red | top red_user

If I chosse green the search should look like:

index=green | top green_user

Normally it is not a problem to use the token from the drop down in a search, but how can I handle it if the complete search should changing after choosing a field in the drop down?

Thank you

Regards

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Create a macro for each case. In the drop-down, put the name of the macro for the value that corresponds to each choice.

The search template then could be

<searchtemplate>
    `$var$`
</searchtemplate>

That's the best that I can come up with. Plus it gives you the flexibility to change the macro without changing the dashboard.

View solution in original post

lguinn2
Legend

Create a macro for each case. In the drop-down, put the name of the macro for the value that corresponds to each choice.

The search template then could be

<searchtemplate>
    `$var$`
</searchtemplate>

That's the best that I can come up with. Plus it gives you the flexibility to change the macro without changing the dashboard.

nebel
Communicator

thank you very much!

0 Karma

lguinn2
Legend

The token is substituted into the search string. So if the token is $var$, you could simply put it in the search template (of the XML) as

<searchTemplate>
    index=$var$ | top $var$_user
 </searchTemplate>

This should work...

0 Karma

nebel
Communicator

does nobody know how I can change the full search string by choosing a field in a drop down?

0 Karma

nebel
Communicator

Hi,

this was just an easy example, my searches are more complicated with regex and stuff. I think I have to replace the complete search based on the drop down.

Thank you

Regards

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...