topic Re: How to exclude condition from search depending on variable? in Splunk Search

How to exclude condition from search depending on variable?

yurykiselev — Tue, 29 Sep 2020 14:38:11 GMT

Hi!

On my dashboard there is the dropdown list. I want to exlude its token criteria from search query if default value "notdef" is selected. i.e.:

if("$dropdown_token$" == "notdef")
    | WHERE param1 = $param1_token$ AND param2 = $param2_token$
else
    | WHERE param1 = $param1_token$ AND param2 = $param2_token$ AND dropdown_param = $dropdown_token$

I tried to use match replaceing "notdef" by empty sting while "notdef" is selected:

| eval dropdown_req = if("$dropdown_token$" == "notdef", "", "$dropdown_token$")
| WHERE param1 = $param1_token$ AND param2 = $param2_token$ AND match(dropdown_param, dropdown_req)

, but values of $dropdown_token$ include the sign "*" (e.g. "*A") and it doesn't work in regex in match().

Thank you!

Re: How to exclude condition from search depending on variable?

dineshraj9 — Thu, 22 Jun 2017 07:07:18 GMT

Can you try this way -

| eval flag=if(like("$dropdown_token$","notdef"),"*","$dropdown_token$") | search param1=$param1_token$ AND param2=$param2_token$ | where dropdown_param=flag

Re: How to exclude condition from search depending on variable?

niketn — Thu, 22 Jun 2017 09:48:08 GMT

You can create the where filter directly from change event of the dropdown using eval. I have given an example based on the details provided. Dropdown choice values might change as per your use case (I expected one of the choice values is notdef).

<input type="dropdown" token="dropdown_token" searchWhenChanged="true">
  <label>Select Field</label>
  <choice value="notdef">Not Defined</choice>
  <choice value="*">All</choice>
  <change>
    <eval token="filterQuery">if($value$=="notdef"," | WHERE param1=$param1_token$ AND param2=$param2_token$", " | WHERE param1=$param1_token$ AND param2=$param2_token$ AND dropdown_param = $value$")</eval>
  </change>
</input>

Re: How to exclude condition from search depending on variable?

yurykiselev — Thu, 22 Jun 2017 12:30:15 GMT

I solved this using token prefix-postfix:

  <prefix>| where dropdown_param = "</prefix>
  <suffix>"</suffix>

and blank as default value.

Thank you all!