topic How to implement an if/else condition in forms? in Dashboards & Visualizations

How to implement an if/else condition in forms?

sfmandmdev — Sat, 23 Oct 2010 01:04:19 GMT

I have a form with a field called "Input" where a splunk user can type in a value-likeA,B,C etc. I want my form to run the search based on what the user inputs.

so, the logic should be:

if(input="X")
    then splunk search="index=!* index=*X...."
else
    splunk search="index=*..."

How can I enforce that condition in my forms? Thanks

Re: How to implement an if/else condition in forms?

gkanapathy — Sun, 24 Oct 2010 09:36:01 GMT

You can probably do this by creating a macro for your search string (or a portion of your search string) and substituting in the form value to the macro argument.

Re: How to implement an if/else condition in forms?

southeringtonp — Sun, 24 Oct 2010 11:11:41 GMT

Maybe not quite what you're looking for, but have you considered changing from a free-form input to a dropdown menu?

You likely would have to use the Advanced XML syntax, but with that approach, you can have different fields for the label displayed to the user and the actual value passed to the search. So in the dropdown, the label would be X, but the "value" would be index=!* index=*X....

Once you have that, you can use stringreplace to insert that into your search string.

Re: How to implement an if/else condition in forms?

sfmandmdev — Tue, 26 Oct 2010 00:24:17 GMT

I don't want to create a dropdown- because its a long and ever-changing list.Thanks though!

Re: How to implement an if/else condition in forms?

sfmandmdev — Mon, 28 Sep 2020 09:19:45 GMT

Okay, say my macro is foo($arg$) where arg is either:(index!=X index=$input$) OR (index=$input$) depending on what the user enters(input is that value)

How , then, in my form do i specify this if/else condition?
if(input=X)
foo(index=$input$*)
if(input!=X)
foo(index!=*X index=$input$)

Re: How to implement an if/else condition in forms?

southeringtonp — Tue, 26 Oct 2010 02:21:58 GMT

Fair enough. Just remember that you can use a search string to populate the list, so only the exception cases would necessarily require manual intervention.