topic Re: If/Else Conditions in a form base on Dropdown Selection in Splunk Search

If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Thu, 15 May 2014 14:15:06 GMT

I've created a form that has a dropdown where users can select their sourcetype. Within each sourcetype, the fields are different. Is there a way for me to have the associated fields available based on the sourcetype that the user selects? If so how do I do this? Below is my form.

<form>
<label>Threat Dashboard</label>
   <fieldset autoRun="false" submitButton="true">
      <input type="text" token="src_ip">
      <label>Source IP:</label>
      <default>*</default>
    </input>
      <input type="text" token="src_port">
      <label>Source Port:</label>
      <default>*</default>
    </input>
    <input type="text" token="dst_ip">
      <label>Destination IP:</label>
      <default>*</default>
    </input>
    <input type="text" token="dst_port">
      <label>Destination Port:</label>
      <default>*</default>
    </input>
    <input type="dropdown" token="sourcetype">
      <label>Select Sourcetype:</label>
      <default>pan_traffic</default>
      <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype" earliest="-120m" latest="-90m">
        <![CDATA[index=* | stats count by sourcetype]]>
      </populatingSearch>
    </input>
    <input type="time" searchWhenChanged="false">
      <default>
        <earliestTime>-15m</earliestTime>
        <latestTime>now</latestTime>
      </default>
       </input>
  </fieldset>
    <row>
    <table>
      <title>Investigate Source IP: $src_ip$</title>
      <searchString>sourcetype=$sourcetype$ src_ip=$src_ip$ dst_ip=$dst_ip$ src_port=$src_port$ dst_port=$dst_port$ | table src_ip, dst_ip, action, src_port, dst_port</searchString>

    </table>
  </row>
  </form>

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Thu, 15 May 2014 15:07:17 GMT

Are you saying you want to customize filters used in search and fields displayed in table based on sourcetype selected?

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Mon, 28 Sep 2020 16:37:44 GMT

ok let's say the fields src_ip and dst_ip is only available when the user select proxysg as their sourcetype. let's say I want client_ip and dest_ip available in my search result when the user select sourcetype=pan_traffic in the drop down. So based on the sourcetype selected, I want those field available that are associated with the sourcetype.

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Thu, 15 May 2014 16:09:03 GMT

Try this in you searchString for the table.

  sourcetype=$sourcetype$ src_ip=$src_ip$ dst_ip=$dst_ip$ src_port=$src_port$ dst_port=$dst_port$ | table [|stats count| eval search=case("$sourcetype$"="proxysg","src_ip, dst_ip, action","$sourcetype$"="pan_traffic","action, src_port, dst_port", 1=1,"src_ip, dst_ip, action, src_port, dst_port")  | table search]

Update:

sourcetype=$sourcetype$  [|stats count | eval src_ip="$src_ip$" | eval dst_ip="$dst_ip$" 
| eval src_port="$src_port$" | eval dst_port="$dst_port$" | eval client_ip="$src_ip$" 
| eval dest_ip="$dst_ip$" | eval port=split("$src_port$,$dst_port$",",") | mvexpand port
| eval host=port
| table [|stats count| eval search=case(
"$sourcetype$"="proxysg","client_ip,dest_ip,port",
"$sourcetype$"="pan_traffic" OR "$sourcetype$"="pan_threat","src_ip, dst_ip,src_port,dst_port", 
"$sourcetype$"="ciscoios", "host" ,
1=1,"")  | table search] | format]
| table [|stats count| eval search=case(
"$sourcetype$"="proxysg","client_ip, dest_ip, action,port",
"$sourcetype$"="pan_traffic" OR "$sourcetype$"="pan_threat","src_ip,dst_ip,action,src_port,dst_port", 
"$sourcetype$"="ciscoios", "host,action,syslog_message" ,
1=1,"*")  | table search]

Re: If/Else Conditions in a form base on Dropdown Selection

Lazarix — Thu, 15 May 2014 16:24:26 GMT

You want something similar to this, I believe:

Possible Solution

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Thu, 15 May 2014 16:44:59 GMT

I tried this and I got an error in my eval command: The expression is malformed. Expected ).

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Thu, 15 May 2014 17:50:29 GMT

My bad, missed one bracket. Updated the answer. Try now.

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Thu, 15 May 2014 18:08:51 GMT

I tried it and I didn't get anything back for the proxysg sourcetype.

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Thu, 15 May 2014 18:19:33 GMT

The filters in the base search also needs to be filtered based on sourcetype. Try the updated answer.

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Mon, 28 Sep 2020 16:37:55 GMT

it seems like it's on the right track, but I'm still not getting results. I have the default sourcetype=pan_traffic in the dropdown and the fields are src_ip, dst_ip, src_port, dst_port. In proxysg, fields are client_ip, dest_ip, port.

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Mon, 28 Sep 2020 16:37:58 GMT

This was the critical information missing from the question. Can you confirm the final list of sourcetype-field list and mapping to dropdown in the form.

sourcetype=pan_traffic

field dropdown

src_ip src_ip
dst_ip dst_ip
src_port src_port
dst_port dst_port

sourcetype=proxysg

field dropdown

client_ip src_ip
dest_ip dst_ip
port src_port OR dst_port????

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Mon, 28 Sep 2020 16:38:01 GMT

in the proxysg, there is only port, which would be for the src_port and dst_port

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Mon, 28 Sep 2020 16:38:03 GMT

What should be the query if you want to search proxysg logs with dropdown values? Will it be this?

sourcetype=proxy client_ip=$src_ip$ dest_ip=$dst_ip$ port=$src_ip$ OR port=$dst_ip$

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Thu, 15 May 2014 20:21:44 GMT

yes that's right.

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Thu, 15 May 2014 20:42:14 GMT

Try updated answer now.

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Fri, 16 May 2014 13:35:48 GMT

I tried the update and I didn't get any results when proxysg was the sourcetype.

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Mon, 28 Sep 2020 16:38:27 GMT

Does this returns records with both sourcetype is selected.

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Fri, 16 May 2014 14:10:41 GMT

I get results back when I select pan_traffic as my sourcetype but nothing back when I select proxysg as my sourcetype from the dropdown.

Re: If/Else Conditions in a form base on Dropdown Selection

somesoni2 — Mon, 28 Sep 2020 16:38:30 GMT

I created the same dashboard (with my query) and the final query being executed (I can see results as I don't have the data) is below (for sourcetype selected as proxysg and all default dropdown values):-

sourcetype=proxysg ( ( dst_ip="*" AND port="*" AND src_ip="*" ) OR ( dst_ip="*" AND port="*" AND src_ip="*" ) )
| table src_ip, dst_ip, action,port

can you validate if this query returns data for you?

Re: If/Else Conditions in a form base on Dropdown Selection

jaywilwk — Mon, 28 Sep 2020 16:38:32 GMT

it doesn't return any data for me. the fields for proxysg are client_ip and dest_ip instead of src_ip and dst_ip.