topic Re: Execute/ignore block of code based on token values? in Splunk Search

How to execute/ignore block of code based on token values?

jonvijay1993 — Wed, 24 May 2023 08:48:27 GMT

I have a union [] command that I want to execute only if a check box is checked, how can I manage this? SPL2 branch doesn't work on my dashboard for some reason and the eval if else only works for assigning a value to a var, what options do I have now?

| search | if value = 'so and so' execute union [sql]

Re: Execute/ignore block of code based on token values?

ITWhisperer — Wed, 17 May 2023 14:18:34 GMT

SPL is not a procedural language.

Depending on you actual usecase, you could set a token value based on whether the check box is checked which includes all the SPL you want included in your search, and then just use this token in the search.

Re: Execute/ignore block of code based on token values?

jonvijay1993 — Wed, 17 May 2023 14:24:59 GMT

I am doing that right now, and it's messy, very messy because my block of code is large and has many other tokens in it. It's just a big mess.

Re: Execute/ignore block of code based on token values?

ITWhisperer — Wed, 17 May 2023 14:28:09 GMT

Another possibility (untested) is that you set the value of the checkbox token to 3 backticks (denoting start/end of comment) and place the token at the beginning and end of your union commands

Re: Execute/ignore block of code based on token values?

ITWhisperer — Wed, 17 May 2023 14:33:20 GMT

Another possibility is that you use appendpipe with a where clause to evaluate whether the token is set at the beginning and the rest of the SPL following the where clause

More than one way to skin a cat!

Re: Execute/ignore block of code based on token values?

jonvijay1993 — Wed, 17 May 2023 14:36:09 GMT

can you give me an example in code, this seems interesting
this method of skinning a cat seems interesting

Re: Execute/ignore block of code based on token values?

ITWhisperer — Wed, 17 May 2023 14:41:07 GMT

You want to add a change handler to the checkbox so that if the box is not checked, it sets the token to "```" and if it is checked, it sets it to ""

| search | appendpipe [$checkboxtoken$ | spl for additional events $checkboxtoken$]

Re: Execute/ignore block of code based on token values?

ITWhisperer — Wed, 17 May 2023 14:42:53 GMT

| search | appendpipe [| where $token$="value meaning execute SPL" | spl to execute]

Re: Execute/ignore block of code based on token values?

jonvijay1993 — Wed, 17 May 2023 14:45:09 GMT

Is ``` some sort of commenting?

Re: Execute/ignore block of code based on token values?

ITWhisperer — Wed, 17 May 2023 14:46:52 GMT

Yes, as of Splunk version 8.something I think

Re: Execute/ignore block of code based on token values?

jonvijay1993 — Wed, 17 May 2023 14:48:21 GMT

I'm gonna try these and get back to you sir, May the Splunk God be with you!

Re: Execute/ignore block of code based on token values?

jonvijay1993 — Wed, 24 May 2023 08:46:11 GMT

Hi, I found another solution to my issue that doesn't require me to have the 2nd block of code in the first place. But if I did go ahead with that block I'd have chosen this method. Thanks!