All Apps and Add-ons

How to conditionally break out of a search

kragel
Path Finder

I have a view with multiple searches. When I execute search #2, if the value of action = discard I want to display the results with a table and stop everything. But if action != discard I want to move on to search #3, then continue on to search #4, etc.

I can't figure out how to accomplish this or do it another way. I don't know if I need to use if(X,Y,Z) or close my modules differently or something else. Does anyone have any suggestions and/or an example? Thanks.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>  
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
 </module>
 <module name="TextField" layoutPanel="panel_row1_col1">
   <param name="name">address</param>
   <param name="float">left</param>
   <module name="Button">
     <param name="allowSoftSubmit">True</param>
     <module name="TimeRangePicker">
       <param name="default">Last 4 hours</param>
       <module name="Search">
         <param name="search">search #1| table somefields</param>
         <module name="Search">
           <param name="search">search #2| table somefields</param>
           <module name="Search">  
             <param name="search">search #3| table somefields</param>
             <module name="Search">
               <param name="search">search #4| table somefields</param>
             </module>
           </module>
         </module>
       </module>
...
</view>
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can build some (mildly crude) branching with a combination of ResultsValueSetter and Gate:

<module name="Search">
  <param name="search">
    <![CDATA[| stats count | eval address="$address$" | eval nope=case(address=="discard","something") | eval yep = case(isnull(nope),"something")
    ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">yep,nope</param>
    <module name="Gate">
      <param name="requiredKeys">yep</param>
      <module name="Table" />
    </module>
    <module name="Gate">
      <param name="requiredKeys">nope</param>
      <module name="Search">
        <param name="search">| stats count | eval address="nope"</param>
        <module name="Table" />
      </module>
    </module>
  </module>
</module>

There's an $address$ token passed from your upstream text field. The first search has formed a decision, denoted by the presence of either field yep or field nope. These are made available as tokens $yep$ and $nope$, allowing exactly one Gate to open. One subbranch displays the most recent search result (add field hiding to get rid of yep later), the other subbranch runs another search before displaying the result.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can build some (mildly crude) branching with a combination of ResultsValueSetter and Gate:

<module name="Search">
  <param name="search">
    <![CDATA[| stats count | eval address="$address$" | eval nope=case(address=="discard","something") | eval yep = case(isnull(nope),"something")
    ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">yep,nope</param>
    <module name="Gate">
      <param name="requiredKeys">yep</param>
      <module name="Table" />
    </module>
    <module name="Gate">
      <param name="requiredKeys">nope</param>
      <module name="Search">
        <param name="search">| stats count | eval address="nope"</param>
        <module name="Table" />
      </module>
    </module>
  </module>
</module>

There's an $address$ token passed from your upstream text field. The first search has formed a decision, denoted by the presence of either field yep or field nope. These are made available as tokens $yep$ and $nope$, allowing exactly one Gate to open. One subbranch displays the most recent search result (add field hiding to get rid of yep later), the other subbranch runs another search before displaying the result.

kragel
Path Finder

ResultsValueSetter and Gate accomplished what I needed. Thanks.

0 Karma

kragel
Path Finder

Search #2 returns at most 10 results. But they all have the same value for the field I'm looking at so I only really need one result.

Thanks for the suggestion on ResultsValueSetter and Gate. I'm currently trying to get that to work.

0 Karma

somesoni2
Revered Legend

How many rows does your search #2 returns??

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...