Answer by warren for Splunk – Create customized query for Splunk dashboard based on Input selection

Investigate dashboard tokens

In your input field(s) (radio, dropdown, etc) on your dashboard, set the token to have multiple possible options (static or dynamic – your choice)

Then in your SPL, do the following:

index=ndx "$mytoken$" msg=*
| sort 0 - _time
| table msg

from User warren – Stack Overflow https://stackoverflow.com/questions/69981364/splunk-create-customized-query-for-splunk-dashboard-based-on-input-selection/69991522#69991522
via IFTTT