All Apps and Add-ons

How to conditionally break out of a search

kragel
Path Finder

I have a view with multiple searches. When I execute search #2, if the value of action = discard I want to display the results with a table and stop everything. But if action != discard I want to move on to search #3, then continue on to search #4, etc.

I can't figure out how to accomplish this or do it another way. I don't know if I need to use if(X,Y,Z) or close my modules differently or something else. Does anyone have any suggestions and/or an example? Thanks.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>  
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
 </module>
 <module name="TextField" layoutPanel="panel_row1_col1">
   <param name="name">address</param>
   <param name="float">left</param>
   <module name="Button">
     <param name="allowSoftSubmit">True</param>
     <module name="TimeRangePicker">
       <param name="default">Last 4 hours</param>
       <module name="Search">
         <param name="search">search #1| table somefields</param>
         <module name="Search">
           <param name="search">search #2| table somefields</param>
           <module name="Search">  
             <param name="search">search #3| table somefields</param>
             <module name="Search">
               <param name="search">search #4| table somefields</param>
             </module>
           </module>
         </module>
       </module>
...
</view>
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can build some (mildly crude) branching with a combination of ResultsValueSetter and Gate:

<module name="Search">
  <param name="search">
    <![CDATA[| stats count | eval address="$address$" | eval nope=case(address=="discard","something") | eval yep = case(isnull(nope),"something")
    ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">yep,nope</param>
    <module name="Gate">
      <param name="requiredKeys">yep</param>
      <module name="Table" />
    </module>
    <module name="Gate">
      <param name="requiredKeys">nope</param>
      <module name="Search">
        <param name="search">| stats count | eval address="nope"</param>
        <module name="Table" />
      </module>
    </module>
  </module>
</module>

There's an $address$ token passed from your upstream text field. The first search has formed a decision, denoted by the presence of either field yep or field nope. These are made available as tokens $yep$ and $nope$, allowing exactly one Gate to open. One subbranch displays the most recent search result (add field hiding to get rid of yep later), the other subbranch runs another search before displaying the result.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can build some (mildly crude) branching with a combination of ResultsValueSetter and Gate:

<module name="Search">
  <param name="search">
    <![CDATA[| stats count | eval address="$address$" | eval nope=case(address=="discard","something") | eval yep = case(isnull(nope),"something")
    ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">yep,nope</param>
    <module name="Gate">
      <param name="requiredKeys">yep</param>
      <module name="Table" />
    </module>
    <module name="Gate">
      <param name="requiredKeys">nope</param>
      <module name="Search">
        <param name="search">| stats count | eval address="nope"</param>
        <module name="Table" />
      </module>
    </module>
  </module>
</module>

There's an $address$ token passed from your upstream text field. The first search has formed a decision, denoted by the presence of either field yep or field nope. These are made available as tokens $yep$ and $nope$, allowing exactly one Gate to open. One subbranch displays the most recent search result (add field hiding to get rid of yep later), the other subbranch runs another search before displaying the result.

kragel
Path Finder

ResultsValueSetter and Gate accomplished what I needed. Thanks.

0 Karma

kragel
Path Finder

Search #2 returns at most 10 results. But they all have the same value for the field I'm looking at so I only really need one result.

Thanks for the suggestion on ResultsValueSetter and Gate. I'm currently trying to get that to work.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How many rows does your search #2 returns??

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...