topic Re: Return fields based on boolean value in Splunk Search

Return fields based on boolean value

hegga — Thu, 13 Jul 2017 08:21:25 GMT

Hi,

I have a saved search used by a dashboard which should return different fields based on the boolean value of a string. For example:

if $show_raw_log$ == 1 do
   | fields _raw

if $show_raw_log$ == 0 do
   | fields _time,  sender, recipient, message_subject, attachment, vendor_action, message_id
   | fields - _raw

How can I achieve this in Splunk?

Re: Return fields based on boolean value

niketn — Tue, 29 Sep 2020 14:59:47 GMT

@hegga, more details please. What sets the Boolean value $show_raw_log$ , is it going to be a form input, a search or a drilldown event?

In any case you can use eval tag to set a query string token to be passed to your actual search.

<eval token="queryString">if($show_raw_log$==1, "| fields _raw", "| fields _time,  sender, recipient, message_subject, attachment, vendor_action, message_id | fields - _raw")</eval>

Then use token queryString in your actual search.
PS: Where ever in your current code you are setting $show_raw_log$ eval tag similar to the one above needs to be added, which implies $show_raw_log$ might not exist or may be represented by some other field/value or token.

Re: Return fields based on boolean value

hegga — Fri, 21 Jul 2017 07:21:03 GMT

Thanks @niketnilay! I'd wish you'd submitted this as an answer, so I could accept it. The boolean field is input from a checkbox in a dashboard which will be used in a search.

Re: Return fields based on boolean value

niketn — Fri, 21 Jul 2017 07:24:43 GMT

@hegga, I have converted to answer. Please accept 🙂