All Apps and Add-ons

Merge selected values of two checkboxes

bever
Explorer

Hi All,

I would like to merge the selected values from 2 checkboxes both working on the same research field (myField).

Checkboxes test1 returns: ( myField="staticValue1" OR myField="staticValue2" OR myField="staticValue3" ) when all boxes are selected and

Checkboxes test2 returns ( myField="staticValue4" OR myField="staticValue5" OR myField="staticValue6" ) when all boxes are selected.

I finally merge the two strings in my search by doing:

<param name="search">index="index_test" ($test1$ OR $test2$) </param>

This works fine as long as at least one box is checked in each checkboxes.

Is there a way to handle this situation by avoiding an incomplete statement like ( OR $test2$) ?

I would like to avoid the use of only one checkboxes for all my choices as I have to group them by theme.

Thank you for your help

<!-- Checkboxes 1 -->
    <module name="Checkboxes" group="static config 1">
      <param name="name">test1</param>   
      <param name="staticCheckboxes">
        <list>
          <param name="label">firstStaticLabel</param>
          <param name="value">staticValue1</param>
        </list>
        <list>
          <param name="label">secondStaticLabel</param>
          <param name="value">staticValue2</param>
        </list>
        <list>
          <param name="label">thirdStaticLabel</param>
          <param name="value">staticValue3</param>
        </list>
      </param>
      <param name="separator">+OR+</param>
      <param name="template">myField="$value$"</param>
      <param name="outerTemplate">( $value$ )</param>


    <!-- Checkboxes 2 -->

    <module name="Checkboxes" group="static config 2">
           <param name="name">test2</param>   
      <param name="staticCheckboxes">
        <list>
          <param name="label">StaticLabel4</param>
          <param name="value">staticValue4/param>
        </list>
        <list>
          <param name="label">StaticLabel5</param>
          <param name="value">staticValue5</param>
        </list>
        <list>
          <param name="label">StaticLabel6</param>
          <param name="value">staticValue6</param>
        </list>
      </param>
      <param name="separator">+OR+</param>
      <param name="template">myField="$value$"</param>
      <param name="outerTemplate">( $value$ )</param>

   <module name="Search">
      <param name="search">index="index_test" ($test1$ OR $test2$) </param>
    </module>
    </module>
    </module>
1 Solution

bever
Explorer

A ValueSetter followed by an ArrayValueSetter does the job: the results from the two checkboxes are merged in the ValueSetter and then parsed into the search string format.
$mergedResults$ contains in the end:

 ( myField="staticValue1" OR myField="staticValue2" OR myField="staticValue3" OR myField="staticValue4" OR myField="staticValue5" OR myField="staticValue6" )

<module name="ValueSetter">
            <param name="name">testResultArray</param>
            <param name="value">$test1.rawValue$,$test2.rawValue$</param>
            <param name="delim">,</param>  

         <module name="ArrayValueSetter">
                <param name="name">mergedResults</param>
                <param name="array">$testResultArray$</param>
                <param name="template">$value$</param>
                <param name="separator">+OR+</param>
                <param name="outerTemplate">( $value$ )</param>
        </module>
     </module>

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

I like your answer with ValueSetter+ArrayValueSetter better, but here's a second way to do it. You make the OR itself dynamic and you use requiredKeys param on ValueSetter to only create the OR when it's needed.

<module name="ValueSetter">
  <param name="name">conditionalComma</param>
  <param name="value">OR</param>
  <param name="requiredKeys">test1,test2</param>

  <module name="Search">
    <param name="search">$test1$ $conditionalComma$ $test2$</param>

(Incidentally one might think your answer would result in a trailing OR if one side or the other was empty, but that problem is avoided because ArrayValueSetter is smart enough to ignore null entries in the array.)

bever
Explorer

A ValueSetter followed by an ArrayValueSetter does the job: the results from the two checkboxes are merged in the ValueSetter and then parsed into the search string format.
$mergedResults$ contains in the end:

 ( myField="staticValue1" OR myField="staticValue2" OR myField="staticValue3" OR myField="staticValue4" OR myField="staticValue5" OR myField="staticValue6" )

<module name="ValueSetter">
            <param name="name">testResultArray</param>
            <param name="value">$test1.rawValue$,$test2.rawValue$</param>
            <param name="delim">,</param>  

         <module name="ArrayValueSetter">
                <param name="name">mergedResults</param>
                <param name="array">$testResultArray$</param>
                <param name="template">$value$</param>
                <param name="separator">+OR+</param>
                <param name="outerTemplate">( $value$ )</param>
        </module>
     </module>
0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...