Splunk Search

Is there a way to display a different name in a drop-down list, but use the original string value in the search using the chart replace function?

sreelesh_n
New Member

Hi

I have a drop-down and Chart/List. The chart should show the event on the item selected from list.

Is there a way display the ProcessContext_ProjectName in the drop-down list removing Java, but while searching, it should use original string?
The replace function is working replace "Java*" with "*" IN ProcessContext_ProjectName, but while doing the search below on another chart from token_projectname2 , it should pick up from the original string including Java.
Right now, the chart is always giving a blank result if I do a filter by Replace.

<input type="dropdown" token="token_projectname2" searchWhenChanged="true">
      <search>
        <query>index=u2 sourcetype=jms_body_header_txt     | dedup   ProcessContext_ProjectName | table ProcessContext_ProjectName</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <fieldForLabel>ProcessContext_ProjectName</fieldForLabel>
      <fieldForValue>ProcessContext_ProjectName</fieldForValue>
    </input>
0 Karma

gyslainlatsa
Motivator

hi sreelesh_n,

try to write like this: replace "Java *" WITH "*" IN ProcessContext_ProjectName

if that does not work, please me you post your entire code and then I can look at the problem.

0 Karma

sundareshr
Legend

The dropdown takes two parameters Name field and Value field. You could add a field for the name like | eval name_field=replace(ProcessContext_ProjectName, "Java*", "*") and then in the dropdown, use the name_field for the fieldForLabel and set value field as ProcessContext_ProjectName.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...