Hi Team,
My current configs has drop down with one token , 3 choice value and 1 search query below.
$api_cached_realtime_token$ is replaced by choice value as per 3 dropdown(All, RealTime, Cached )
Below is original code:
All RealTime Cached apiActualTimeTaken apiActualTimeTaken index=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct apiStatus=* | timechart span=1h avg($api_cached_realtime_token$) as AVG, P95($api_cached_realtime_token$) as P95 $time_token.earliest$ $time_token.latest$
Now I am moving into summary index.
summary_index is = my_summary_index I am writing all the above into summary index by using search query below.
``index=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct apiStatus=* | stats avg(apiActualTimeTaken) as AVG_Actual avg(realTime_timeTaken) as AVG_real avg(cached_timeTaken) as AVG_cached P95(apiActualTimeTaken) as P95_Actual P95(realTime_timeTaken) as P95_real P95(cached_timeTaken) as P95_cached``
Pls help me achieve same with 3 dropdown (All, RealTime, Cached ) that output search for respective drop-down. (one-token-multiple value-perhaps)
index=my_summary_index | stats sum(AVG_Actual or AVG_real or AVG_cached ) as AVG sum(P95_Actual or P95_real or P95_cached) as per dropdown(All, RealTime, Cached ) respectively.
I tried This article helped a bit but could not achieve yet.
https://answers.splunk.com/answers/525245/how-to-pass-multiple-values-for-a-field-through-to-1.html
↧