Splunk dashboard: Writing a dynamic query

Another day, another thing to learn , this spices up my job.

Today i built a dashboard , i want the user provide me a list of keywords from an input text, then i will search based on that. The challenge is it’s a list of keywords separated by comma. It’s easy if the user provide a string like this: hostname=”hostA” OR hostname=”hostB” OR hostname=”hostC” , instead the user will provide me this : hostA,hostB,hostC . I know that i have to split this our and turn the list keywords into a format that Splunk can understand.

I know how to turn this hostA,hostB,hostC into hostname=”hostA” OR hostname=”hostB” …

| makeresults 
| eval hostlist="hostA,hostB,hostC"
|  eval hostlist="hostname=\"*".replace(hostlist,",","*\" OR host_fullname=\"*")."*\"" | fields hostlist

Cool right ? but how do you put this query in to your order query, you might have a query like this

index=os hostname="*hostA" OR hostname="*hostB"

How do we pass our first query result into our second query? This can be resolved by using set token in the dashboard query. What it does is that in your <search> you setup <done>, it will setup the result to a token (my_second_query_token) , that token then can be used anywhere in your dashboard. When your token changed, your search result will be also updated.

  <search>
    <query>| | makeresults 
| eval hostlist="hostA,hostB,hostC"
|  eval hostlist="hostname=\"*".replace(hostlist,",","*\" OR host_fullname=\"*")."*\"" | fields hostlist</query>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
    <done>
      <set token="my_second_query_token">$result.final_query$</set>
    </done>
  </search>

<row>
    <panel>
      <title>MyDashboard</title>
      <table>
        <search>
          <query>| myquery | search $my_second_query_token$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>