Splunk - Create customized query for Splunk dashboard based on Input selection

user_2769790 0
Viewed 666

I'm creating a Dashboard in Splunk. It has one dropdown menu to select App-name(App1 or App2), another drop-down to select log_type (Detailed and App_specific), and a Search panel to show output of search query.

For instance,

  1. If user selects App1 and log_type as app_specific, then the Panel should result for the query:

index=App1 "taskExecutor-1" | sort -_time | table msg

For App1, selecting app_specific should add "taskExecutor-1" to the query.

  1. If user selects App2 and log_type as app_specific, then the Panel should result for the query:

index=App2 "ool-44-thread-1" | sort -_time | table msg

For App2, selecting app_specific should add "ool-44-thread-1" to the query.

    1. If user selects App1 and log_type as Detailed, then the Panel should result for the query:

index=App1 | sort -_time | table msg

Selecting Detailed should not anything to the query. Or we can say, an empty value.

How can I customize the query to accommodate such behavior in Splunk? Is there any any if/else or case functionality in Splunk that can help achieve this behavior?

splunk-dashboard splunk-query splunk
1 Answers

Investigate dashboard tokens

In your input field(s) (radio, dropdown, etc) on your dashboard, set the token to have multiple possible options (static or dynamic - your choice)

Then in your SPL, do the following:

index=ndx "$mytoken$" msg=*
| sort 0 - _time
| table msg
warren_44180
Related