I am trying to define a chained search where filters are applied if the corresponding token is set. But, in the example below, the depends attribute seems not to work as expected. The search is waiting for input as long as fooFilter or barFilter is not set. Splunk Verion is 6.6.8 and according to the doc, the depends attribute should be supported in searches. What did I miss?
index=a | stats count by foo bar $globalTimePicker.earliest$ $globalTimePicker.latest$
where foo=$fooFilter$
where bar=$barFilter$
sort -count
↧
