Splunk Search

How can I do different searches based on the inputfield value?

alex_kh
Explorer

Hello everybody,

In my dashboard i have two input fields
Primary_field =*
Secondary field=*

my current search looks like

index=* ip=$primary_filed_value$

I want extend it with the secondary field.

But if write my search like

index=\* ip=$primary_filed_value$ user=$secondary_filed_value$

and the *$secondary_filed_value$ = **
i get ONLY the results where user != NULL

But i need everything

ip
1.1.1.1 alex
1.1.1.1 bill
1.1.1.1 NULL

Any ideas?

Tags (1)
0 Karma
1 Solution

kmaron
Motivator

you could load the user field with values so that there never is a NULL

index=* ip=$primary_filed_value$
| eval user = if(length(user)>0,user,"none")
| search user=$secondary_filed_value$

View solution in original post

kmaron
Motivator

you could load the user field with values so that there never is a NULL

index=* ip=$primary_filed_value$
| eval user = if(length(user)>0,user,"none")
| search user=$secondary_filed_value$

renjith_nair
SplunkTrust
SplunkTrust

@alex_kh,

Try adding

user="*" OR NOT user="*"

Here is a run anywhere example with inputs and tokens covering both empty and null

<form>
  <label>Adding Null when selecting All</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="username">
      <label>UserName</label>
      <choice value="*">All</choice>
      <choice value="admin">Admin</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <change>
        <condition label="All">
          <set token="username">"*" OR NOT user="*"</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval user="admin,nonadmin,EMPTY,NULL"|makemv user delim=","
                 |mvexpand user|eval user=if(user="NULL",null(),user)
                 |replace EMPTY with ""
                 |search user=$username$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

alex_kh
Explorer

first search is obviously index=* bla bla bla

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...