topic Re: Search query within IF statement? in Dashboards & Visualizations

Search query within IF statement?

rwheeloc — Tue, 19 Nov 2024 15:55:52 GMT

I'm trying to come up with a search query that ignores parameters if left blank, but ignores other parameters if filled in.

In this case, "-" is the default value for token1 and token2. If token1 and token2 are left at this default, I want to find results based only on token3; but if token1 or token2 are specified then I want token3 to be disregarded.

Here's what I've been trying, but so far doesn't seem to be working as I'd hoped:

if(($token1$ == "-" AND $token2$ =="-"), (search Field3=$token3$), (search Field1="$token1$" OR Field2="$token2$"))

Am I on the right track? Something I'm missing?

Re: Search query within IF statement?

richgalloway — Tue, 19 Nov 2024 16:19:15 GMT

SPL does not have conditional execution. The if function (not a command or statement) is part of where and eval expressions to help determine the value to test or assign to a field.

In dashboards, conditional execution can be simulated by assigning different search commands to a token based on the value of other tokens.

<input> ... <condition $token1="-" AND $token2$="-">  <set token="search">Field3=$token$</set> </condition> <condition> <set token="search">Field11=$token1"</set> </condition> </input> ... <search> <query>index=foo $search$</query> </search> ...

Re: Search query within IF statement?

rwheeloc — Tue, 19 Nov 2024 20:49:54 GMT

Thank you!

I'm working on reproducing this in json format for Dashboard Studio, and keep getting an error that the input myast have a 'type' specified... any guidance on what that would need to be?

Re: Search query within IF statement?

richgalloway — Tue, 19 Nov 2024 21:13:05 GMT

My example is more like pseudo-code than something you could paste into a dashboard. No doubt there are many blanks to be filled in.

JSON input types are in the manual at https://docs.splunk.com/Documentation/Splunk/9.3.2/DashStudio/inputConfig#Input_configuration_options_available_in_the_visual_editor