topic Re: How to search based on drop-down condition? in Splunk Search

How to search based on drop-down condition?

LearningGuy — Tue, 19 Mar 2024 19:07:20 GMT

Hello,

How to search based on drop-down condition?
Thank you in advance!

index = test | eval week_or_day_token = "w" (Drop down: if select "week" = "w", "day" = "d) | eval day_in_week_token = 1 (Drop down: if select 0=Sunday, 1=Monday, 2=Tuesday, and so on)

If week_or_day_token is "week", then use day_in_week_token, otherwise if week_or_day_token is "day" , then use all day *

| eval day_in_week = if(week_or_day_token="w", day_in_week_token, "*")

Get what day number in week on each timestamp

| eval day_no_each_timestamp = strftime(_time, "%" + day_in_week_token)

I searched the timestamp that falls on Monday (day_in_week=1), but I got 0 events

| search day_no_each_timestamp = day_in_week

If I replaced it with "1", it worked, although the value day_in_week is 1

| search day_no_each_timestamp = "1"

Re: How to search based on drop-down condition?

Gr0und_Z3r0 — Wed, 20 Mar 2024 12:03:43 GMT

Hi @LearningGuy

Not sure if I understand your requirement correctly. But below maybe something you can use.

<form version="1.1"> <label>Dropdown-token-condition</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="token_week_or_day" searchWhenChanged="true"> <label>Week Or Day</label> <choice value="w">Week</choice> <choice value="d">Day</choice> </input> <input type="dropdown" token="token_day" searchWhenChanged="true"> <label>Day Number</label> <choice value="0">Sunday</choice> <choice value="1">Monday</choice> <choice value="2">Tuesday</choice> <choice value="3">Wednesday</choice> <choice value="4">Thursday</choice> <choice value="5">Friday</choice> <choice value="6">Saturday</choice> </input> </fieldset> <row> <panel> <table> <search> <query>| makeresults | eval selected_week_or_day_option="$token_week_or_day$" | eval selected_day=$token_day$ | table _time selected_week_or_day_option selected_day date_day | eval day_no_each_timestamp=strftime(_time,"%w") | eval day_in_week = if(selected_week_or_day_option="w", $token_day$, "*")</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

If the reply helps, a Karma vote would be appreciated.

Re: How to search based on drop-down condition?

LearningGuy — Wed, 20 Mar 2024 12:15:21 GMT

Hello,

Thank you so much for your response.
The query that contain the search is actually in the statistic table, but the condition is a condition based on the drop down token.

This is the main question:
How to dynamically search / where based on variable like below?

| search day_no_each_timestamp = day_in_week

| where day_no_each_timestamp = day_in_week