topic Re: Conditional statements/output in Dashboards & Visualizations

Conditional statements/output

Branden — Thu, 23 Sep 2010 22:17:19 GMT

I have a search that checks to see if a process particular process is running. Simple enough.

In my dashboard, I want users to be able to see if that process is running. But rather than displaying the process, I'd like to use a "" to simply say "Yes" or "No".

I know Splunk can count the number of results, but is there a way to tell the dashboard to display "Yes" if count>0 and "No" if count==0?

Thanks!

Re: Conditional statements/output

southeringtonp — Thu, 23 Sep 2010 23:08:10 GMT

There are a few options, but a simple way is to use eval to pull out a new field.

Try this:

... | eval yesno=if(count==0, "No", "Yes")

The docs page for eval has some other examples: http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Eval

To use it in your XML, you might do something like this:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">YOUR TERMS HERE | eval yesno=if(count==0, "No", "Yes") | rangemap field=count severe=0-0 default=low</param>
    <module name="SingleValue">
        <param name="field">yesno</param>
        <param name="classField">range</param>
    </module>
</module>

Re: Conditional statements/output

Branden — Fri, 24 Sep 2010 00:04:55 GMT

Thanks for the reply.
Unfortunately, this doesn't seem to work in the context of a dashboard. I keep getting a "mismatched tag:" error when I had the eval statement. The same thing happens when I use a regex. In the search bar it's fine, but not in an XML file...

Re: Conditional statements/output

Branden — Fri, 24 Sep 2010 00:08:34 GMT

Actually I figured out the mis-matched tag issue... but it's still not providing the expected behavior. It's reporting "N/A". But I think you've pointed me in the right direction. I'll try to figure it out from here. Thanks!

Re: Conditional statements/output

southeringtonp — Fri, 24 Sep 2010 06:16:04 GMT

The N/A sounds like you have a SingleValue module that's looking at the wrong field. See edits to answer above.

Re: Conditional statements/output

Branden — Fri, 24 Sep 2010 19:57:00 GMT

I had to change to "