topic Re: Conditional if based on dropdown value (match with a column name for second dropdown) in Splunk Search

Conditional if based on dropdown value (match with a column name for second dropdown)

smhsplunk — Thu, 12 May 2016 14:34:42 GMT

  I have two dropdowns, first one selects T1, T2 or T3. 
  Depending on the first selection the second dropdown will
  match this information with a column name (i.e. T1_sn) in 
  and display all the values under this column in the dropdown.

  First one works fine with choice, I think for the second 
  dropdown which is based on the drilldown value of the 
  first dropdown I cannot do the comparison using the 
  conditional if statement properly.

  Please help.



 <row>
    <panel>

     <input type="dropdown" token="unit_type" searchWhenChange="true">
      <label>Select a traffic unit type</label>
      <default>*</default>
      <choice value="T1">T1</choice>
      <choice value="T2">T2</choice>
      <choice value="T3">T3</choice>

      <option name="count">300</option>
        <drilldown>
          <set token="get_site_code">$click.value$</set>
        </drilldown>
     </input>

      <input type="dropdown" token="traffic_unit_number" searchWhenChange="true">
      <label>Traffic Unit Number: </label>
      <default>*</default>
        <populatingSearch fieldForValue="unit_number" fieldForLabel="unit_number">
          <![CDATA[index=main source=traffic_locations sourcetype=TRAFFIC_DATA 
                  | eval new_val = $unit_type$
                  | eval t1 =  if(new_val=="T1", T1_sn, "")
                  | stats count by t1
                  | table t1]]>
        </populatingSearch>
      </input>
      <row>

Re: Conditional if based on dropdown value (match with a column name for second dropdown)

somesoni2 — Thu, 12 May 2016 15:00:22 GMT

This is bit confusing (the drilldown on input, I don't think you need that), but give this a try

 <panel>

  <input type="dropdown" token="unit_type" searchWhenChange="true">
   <label>Select a traffic unit type</label>
   <default>*</default>
   <choice value="T1">T1</choice>
   <choice value="T2">T2</choice>
   <choice value="T3">T3</choice>     
  </input>

   <input type="dropdown" token="traffic_unit_number" searchWhenChange="true">
   <label>Traffic Unit Number: </label>
   <default>*</default>
     <populatingSearch fieldForValue="unit_number" fieldForLabel="unit_number">
       <![CDATA[index=main source=traffic_locations sourcetype=TRAFFIC_DATA 
               | eval new_val = $unit_type$
               | eval t1 =  if(unit_type=="T1", T1_sn, "")
               | stats count by t1
               | table t1]]>
     </populatingSearch>
   </input>
   <row>

Re: Conditional if based on dropdown value (match with a column name for second dropdown)

smhsplunk — Tue, 29 Sep 2020 09:40:38 GMT

This doesn't work but line 17

| eval t1 =  if(unit_type=="T1", T1_sn, "")

shouldn't it be
| eval t1 = if(new_val=="T1", T1_sn, "")