Is there an example of how to run 2 different searches based on the selected drop-down value on the same panel?

[xvxt006]

Hi,

I need to run 2 different search queries based on the drop-down value on the same panel. Is there an example to do this?

Any suggestions are much appreciated.

[ngatchasandra]

Hi vganjare,

You can that using the dropdown token in two search in the same panel! This is an code example where an user can select one sourcetype in dropdown that will interact with two search in the same panel. The token sourcetype ($sourcetype$) is in the both search like follow, try to run it!

<form>
  <label>Dropdown Form Input Element</label>
  <description>Events Filtered by User and Sourcetype using Dropdown Form Inputs</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>Select a Sourcetype:</label>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
      <default>*</default>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-24h" latest="now">
        <![CDATA[index=_internal | stats count by sourcetype]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Table of Events for All or one sourcetype</title>
        <search>
          <query>index=_internal  $sourcetype$ | table _time, sourcetype, _raw</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="displayRowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">5</option>
        <option name="rowNumbers">true</option>
      </table>
      <table>
        <title>Table of count for All or one sourcetype</title>
        <search>
          <query>index="_internal" $sourcetype$  |stats count by group sourcetype</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="displayRowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">5</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

[vganjare]

Hi,

Have you tried using tokens? More details at Splunk Token Tutorial

If two different searches are using same token (which can be passed from dropdown value), two different searches can show results.

Thanks!!