topic Re: How to skip the part of Search Query based on a Condition in Splunk Search

How to skip the part of Search Query based on a Condition

potnuru — Fri, 20 Nov 2020 10:40:07 GMT

My requirement is just to skip few lines of SPL query if a certain condition is met. Or some kind of If-Else for running the part of SPL.

Exact Requirement:

I have two panels in my Dashboard. In First Panel, we have data for different tickets/sessions which will be passed to panel 2 on selection.

In Panel2, we have to validate certain parameters and if all ok then save the data to Splunk index (using collect command) and show success message otherwise throw error message on to panel2.

Hi @gcusello @niketn @woodcock @somesoni2 @thambisetty, if you guys have any ideas, kindly share it with me.

Re: How to execute the part of Search Query based on a Condition

richgalloway — Wed, 18 Nov 2020 13:52:22 GMT

SPL is not a procedural language and does not support branching like that. The conditional statements in SPL only control the assignment of values to fields.

Re: How to execute the part of Search Query based on a Condition

potnuru — Thu, 19 Nov 2020 06:02:38 GMT

Hi @richgalloway ,

Thank you for your answer.

I know that my requirement is directly not possible as SPL is not procedural language.

But are there any alternatives/ tricks, I mean indirect way to make it possible ?

Re: How to execute the part of Search Query based on a Condition

richgalloway — Thu, 19 Nov 2020 13:25:01 GMT

If there was a general way to do so then I would have said so. Whether or not there's a trick to accomplish your specific goal is impossible to say given the information provided.

Re: How to execute the part of Search Query based on a Condition

potnuru — Thu, 19 Nov 2020 16:19:14 GMT

@richgalloway

My requirement is just to skip few lines of SPL query if a certain condition is met.

So is there any possibility to skip few lines or jump to a specific part of SPL based on condition ?

Exact Requirement:

I have two panels in my Dashboard. In First Panel, we have data for different tickets/sessions which will be passed to panel 2 on selection.

In Panel2, we have to validate certain parameters and if all ok then save the data to Splunk index (using collect command) and show success message otherwise throw error message on to panel2.

Re: How to execute the part of Search Query based on a Condition

richgalloway — Thu, 19 Nov 2020 17:57:10 GMT

Splunk 8.1 has the new require command that can abort a query if zero results were found at that point. I don't know if that helps. I don't know of any other way to skip parts of a query.

Re: How to skip the part of Search Query based on a Condition

gcusello — Fri, 20 Nov 2020 12:04:49 GMT

Hi @potnuru,

probably you already solved the first part of the request: pass a token from the first panel to the second; if not see in Splunk Dashboard Examples (https://splunkbase.splunk.com/app/1603/) how to do this.

If your problem is to have a button that runs a collect command, you cannot do this with simple XML: you need a JS to run a search with the collect command from the dashboard.

It's not possible for me to help more becasue I'm not a JS developer, but you can find useful information at https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard-button-to-run-SPL-on-click/m-p/350732

Ciao.

Giuseppe

Re: How to skip the part of Search Query based on a Condition

potnuru — Fri, 20 Nov 2020 12:30:16 GMT

Hi @gcusello

Thank you for your reply.

I don't need any Button. On selecting a row on Panel1, all the required tokens will be passed to Panel2.

My requirement is to validate the tokens on Panel2,.

1) if tokens values are passed the validation then I need to save the data to Splunk Index.

2) if validation fails, then the data should not be saved on Splunk Index.

Re: How to skip the part of Search Query based on a Condition

gcusello — Fri, 20 Nov 2020 12:34:12 GMT

Hi @potnuru,

how do you think to validate the results?

the easiest way is a button.

Otherwise, you could create another drilldown in an hidden panel containing the collect command.

It isn't a clear way to work for the users: if OK click on a row if it isn't OK no click?

Ciao.

Giuseppe

Re: How to skip the part of Search Query based on a Condition

potnuru — Fri, 20 Nov 2020 12:42:11 GMT

@gcusello if OK click on a row if it isn't OK no click?--> This won't work for me. Because every time user have to click on a row in Dashboard Panel1 and he could see the results in Panel2.

Panel2 Output might be like this:

1) Data is validated successfully and saved to Index.

2) Data validation is failed.

Here validation is simple one, like if the tokens matches with certain parameters (Example: Ticket_Status="Approved")

Re: How to skip the part of Search Query based on a Condition

gcusello — Fri, 20 Nov 2020 14:26:41 GMT

Hi @potnuru,

obviously my hint are two buttons: OK and Exit, the first confirm operation and runs the search with collect, the second one closes the dashboard or clean the search token.

Ciao.

Giuseppe