topic change index value based on the dropdown selection in Splunk SOAR

change index value based on the dropdown selection

kavyakanne — Sun, 07 Jun 2020 16:22:54 GMT

So as per the Daily and Monthly selection index has to vary

Daily = index1
Monthly=index2

Thanks in Advance!

<fieldset>
      <label>Report Type</label>
       <choice value="Daily">Daily</choice>
        <choice value="Monthly">Monthly</choice>
</fieldset>

Re: change index value based on the dropdown selection

kavyakanne — Sun, 17 May 2020 08:38:12 GMT

@gcusello

Could you assist me here!

Thanks in Advance!

Re: change index value based on the dropdown selection

gcusello — Sun, 17 May 2020 08:59:28 GMT

Hi @kavyakanne,
try something like this:

<form>
  <label>Test dropdown 2</label>
  <fieldset submitButton="false">
    <input type="radio" token="index">
      <label>Index</label>
      <choice value="wineventlog">wineventlog</choice>
      <choice value="_internal">_internal</choice>
      <default>wineventlog</default>
      <prefix>index="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>$index$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Obviously, you can use a different search.

Ciao.
Giuseppe

Re: change index value based on the dropdown selection

sanjeev543 — Sun, 17 May 2020 10:00:58 GMT

@kavyakanne perhaps you could try below option if you are looking to change the index name based on the Report Type option that you select

<fieldset submitButton="false">
     <input type="dropdown" token="idx">
       <label>Reporting Type</label>
       <choice value="daily_report_index_name">Daily</choice>
       <choice value="monthly_report_index_name">Monthly</choice>
       <default>daily_report_index_name</default>
     </input>
   </fieldset>
<!-- modify the search query with token name -->
<row>
     <panel>
      <title>Selected index option $idx$<title>
       <table>
         <search>
           <query>index=$idx$</query>
           <earliest>-60m@m</earliest>
           <latest>now</latest>
           </search>
</table>
</panel>
</row>

Re: change index value based on the dropdown selection

gcusello — Sun, 17 May 2020 10:32:31 GMT

Hi @kavyakanne,
instead the index=weekly/monthly, you could insert in the choice the full search for each report,
try something like this:

<form>
  <label>Test dropdown 2</label>
  <fieldset submitButton="false">
    <input type="radio" token="index">
      <label>Index</label>
      <choice value="index=wineventlog | stats count BY EventCode">wineventlog</choice>
      <choice value="index=_internal | table _time source index sourcetype">_internal</choice>
      <default>index=wineventlog | stats count BY EventCode</default>
      <prefix/>
      <suffix/>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$index$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Ciao.
Giuseppe