CODEWITHSUNDEEP
splunksplunk-querysplunk-dashboard
LoganBlack
LoganBlack

Reputation: 254

search query using if or case statement

I'm creating a Splunk Dashboard (using Dashboard Studio) that uses a dropdown to select which environment we want to look at. (PROD, UAT, or INT). The result is stored as a string in a variable called $global_env$.

Sometimes we have the env in the log file name and I can just drop this right in as so: source=logs/my-app/myapp-$global_env$.log

However, some of our legacy apps are not using that standard, and I'll need to map the global_env to a server_name and query it as: host=$server_name$

I'm having a hard time getting this to work and would like a little guidance through a few questions:

  1. Is there a way to set the server_name globally when the environment dropdown changes? (e.g. the user selects "Prod" from the dropdown, setting the global var $global_env$ = "prod" AND a hidden global var of $server_name$="srv01") It doesn't seem like this is possible outright, but maybe there's a trick somewhere I'm missing?

  2. If #1 is not possible, then I'd like to use something like a case or if to set this in the query, like so: host=case($global_env$=="prod", "mysrv1", $global_env$="uat", "mysrvuat1", $global_env$=="int", "mysrvint1") AND ...
    or host=if($global_env$=="prod", "mysrv1", "mysrv$global_env$1")

I've tried #2 a few different ways, but it usually just drops the environment name into the query without seeming to run the case or if statement.

I've tried using an eval like so eval server_name=case(...) | search host=$server_name$ AND ... but that just leaves dashboard widget stuck "Waiting for input..."

Any suggestions how to get this working?

Upvotes: 0

Views: 1823

Answers (1)

RichG
RichG

Reputation: 9976

It is possible to set tokens when a dropdown changes. Put a <set> element within a <change> element to set as many tokens as you like.

<input type="dropdown" token="global_env">
  <choice value="prod">Prod</choice>
  ...
  <change>
    <condition label="Prod">
      <set token="server_name">srv01</set>
    </condition>
  </change>
</input>

Upvotes: 2

Related Questions