Loading...
Skip to content
Warren Myers' Merikebi My online archive
  • RSS
  • Facebook
  • Instagram
  • Pinterest
  • Twitter
  • LinkedIn
  • GitHub
  • Telegram
  • Skype

Pages

  • Welcome to Warren Myers’ Merikebi
  • Pocket

Answer by warren for How Can a Dropdown be Used to Filter Splunk Query Results

Posted on 13 September 2023

Pages

  • Welcome to Warren Myers’ Merikebi

The simplest way to do this will be to create a list in your dropdown who entry values are the field names (ie Model.Old & Model.New)

Call the name of that token, say, modelchoice

Then have a single search on your dashboard that looks like this:

index='splunk_demo' source='demo.zip'
| fields Name, Model.New, Model.Old, Price
| chart count(Name) by $modelchoice$

Splunk does a straight substitution when it encounters a token with whatever the token’s value is.

So if the token’s value is the field name, it will substitute that in

from User warren – Stack Overflow https://stackoverflow.com/questions/77094074/how-can-a-dropdown-be-used-to-filter-splunk-query-results/77096911#77096911
via IFTTT

merikebi

warrenmyers.com
Taggedstackexchange
by merikebiCategories:blih
  • RSS
  • Skype
© Warren Myers' Merikebi. All rights reserved.
Back to top