topic splunk if else in Dashboards & Visualizations

splunk if else

Mohsin123 — Sat, 21 Jul 2018 22:50:07 GMT

Hi,

I have a drop down with list of components . i want to a have a panel which will show stats count by service if component=A is selcted and stats count by component if rest components are selected from the drop down menu .

Is it posiible ?
I tried using

Thanks

Re: splunk if else

renjith_nair — Sun, 22 Jul 2018 00:55:29 GMT

@shraddhamuduli,

You could do it by conditional token. Please find below the run anywhere example.

<form>
  <label>Conditional Drop Down</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="component">
      <label>component</label>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>|tstats count where index=_* by component|fields - count|append [|stats count|eval component="the_special_component"]</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <change>
        <condition value="the_special_component">
          <set token="service_or_component">sourcetype</set>
        </condition>
        <condition>
          <set token="service_or_component">component</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$component$">
      <title>This panel is group by $service_or_component$</title>
      <table>
        <search>
          <query>index=_*|stats count by $service_or_component$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Main elements are below

         <condition value="the_special_component">
           <set token="service_or_component">sourcetype</set>
         </condition>
         <condition>
           <set token="service_or_component">component</set>
         </condition>

When the value of component is the_special_component, it sets the token as sourcetype (service in your case) and token is set to component in all other cases. Finally you will be using the token service_or_component in group by statement.

Hope it helps!

Re: splunk if else

Mohsin123 — Tue, 29 Sep 2020 20:34:40 GMT

Hi Renjith

Thanks. But, your first query sets the dropdown to only one value i.e APIX
Here APIX is my "the_special_component"

Re: splunk if else

Mohsin123 — Tue, 29 Sep 2020 20:34:44 GMT

what i mean is, this line is setting the drop down to only one value i.e the_special_component

     <query>|tstats count where index=idx_apix by component|fields - count|append [|stats count|eval component="the_special_component"]</query>

Re: splunk if else

renjith_nair — Mon, 23 Jul 2018 16:29:49 GMT

You could just do the normal search instead of above and populate the dropdown. However , logic in the dashboard should work for you.
Or do you mean that you have multiple values which needs to be compared?