Dashboards & Visualizations

How to join rows to compare values?

KalebeRS
Explorer

Hello.

I have these two rows (PR_Tags and PR_ID). Need to return the PR_ID's that are matching the PR_Tags when I select in a Dropdown filter (Like if I select the line 1row 1, return the PR_ID's that matches this PR_Tag selected)

KalebeRS_0-1686635236994.png

How can I do that?

 

index= host=  sourcetype=csv source=........\\resul_test.csv 
| table PR_Tags, PR_ID
| eval PR_Tags=split(PR_Tags,",")
| mvexpand PR_Tags
| dedup PR_Tags PR_ID

 

Labels (2)
0 Karma
1 Solution

rrovers
Communicator

maybe this wil help?:

<form version="1.1">
  <label>tmp-pr-tags</label>
  <fieldset>
      <input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
      <label>Selecteer een PR_Tag:</label>
      <choice value="*">PR_Tags...</choice>
      <search>
        <query>
          <![CDATA[
           index=main sourcetype=csv source=result_test.csv 
           | table PR_Tags, PR_ID
           | eval PR_Tags=split(PR_Tags,",")
           | mvexpand PR_Tags
           | dedup PR_Tags PR_ID
          ]]>
        </query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <fieldForLabel>PR_Tags</fieldForLabel>
      <fieldForValue>PR_Tags</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>PR_Tags</title>
      <table>
        <search>
          <query>
           index=main sourcetype=csv source=result_test.csv 
           | where PR_Tags="$dropdown_tok$"
           | table PR_Tags, PR_ID
           | eval PR_Tags=split(PR_Tags,",")
           | mvexpand PR_Tags
           | dedup PR_Tags PR_ID
          </query>
        </search>
        <option name="count">50</option>
        <option name="drilldown">none</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

rrovers
Communicator

maybe this wil help?:

<form version="1.1">
  <label>tmp-pr-tags</label>
  <fieldset>
      <input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
      <label>Selecteer een PR_Tag:</label>
      <choice value="*">PR_Tags...</choice>
      <search>
        <query>
          <![CDATA[
           index=main sourcetype=csv source=result_test.csv 
           | table PR_Tags, PR_ID
           | eval PR_Tags=split(PR_Tags,",")
           | mvexpand PR_Tags
           | dedup PR_Tags PR_ID
          ]]>
        </query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <fieldForLabel>PR_Tags</fieldForLabel>
      <fieldForValue>PR_Tags</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>PR_Tags</title>
      <table>
        <search>
          <query>
           index=main sourcetype=csv source=result_test.csv 
           | where PR_Tags="$dropdown_tok$"
           | table PR_Tags, PR_ID
           | eval PR_Tags=split(PR_Tags,",")
           | mvexpand PR_Tags
           | dedup PR_Tags PR_ID
          </query>
        </search>
        <option name="count">50</option>
        <option name="drilldown">none</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...