All Apps and Add-ons

Sideview Gate - Feature Suggestion - nullKeys

snoobzilla
Builder

Nick,

Something would make more robust logic easier with Gates would be to add a nullKeys parameter that would proceed only if keys listed in that param are null. An anti-requiredKeys parameter if you will.

What do you think?

Regards,

Ian

1 Solution

sideview
SplunkTrust
SplunkTrust

Actually you can get what you need by using a ValueSetter module with a little conditional logic in it.

Say you have a key called "foo" upstream, and you want the Gate to open if foo is null, and be closed when foo has a value.

  <module name="ValueSetter">
    <param name="name">isFooNull</param>
    <param name="if.$foo$=*"></param>
    <param name="default">yes!</param>

downstream from this ValueSetter you can use $isFooNull$ and it'll only have the "yes!" value when $foo$ is null.

This should do it. ValueSetter is exactly for tweaky little tasks like this. In the docs it has a number of different sections going through it's various features. If you've missed the conditional stuff, some other things in there might be useful to you as well.

Also if you'd prefer to get nitty gritty working examples, there's a hidden view that ships in the app called "testcases_for_value_setter_conditionals" that might be useful for cribbing working config from.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Actually you can get what you need by using a ValueSetter module with a little conditional logic in it.

Say you have a key called "foo" upstream, and you want the Gate to open if foo is null, and be closed when foo has a value.

  <module name="ValueSetter">
    <param name="name">isFooNull</param>
    <param name="if.$foo$=*"></param>
    <param name="default">yes!</param>

downstream from this ValueSetter you can use $isFooNull$ and it'll only have the "yes!" value when $foo$ is null.

This should do it. ValueSetter is exactly for tweaky little tasks like this. In the docs it has a number of different sections going through it's various features. If you've missed the conditional stuff, some other things in there might be useful to you as well.

Also if you'd prefer to get nitty gritty working examples, there's a hidden view that ships in the app called "testcases_for_value_setter_conditionals" that might be useful for cribbing working config from.

0 Karma

snoobzilla
Builder

Thanks. I will take a look at this solution.

I have used conditional logic in value setter. For multi-case logic, setting the name of valuesetter using an upstream token from search results/results valuesetter and then used corresponding downstream gates for each branch has worked very nicely.

I was thinking nullKeys solution suggested would be convenient for things like flagging required fields on a form with a simple gate then html module combo with less fuss.

Thanks

Ian

0 Karma

sideview
SplunkTrust
SplunkTrust

Hm. That's a great point. OK I'll put it in the icebox if not the queue and it may very well appear in a future release.

Although, one other way to think about it a little differently and not use a Gate at all, is to do this:

<module name="ValueSetter">
  <param name="name">emptyFieldWarning</param>
  <param name="if.$foo$=*"></param>
  <param name="default"><![CDATA[ 
    <strong>You need to enter a value for foo</strong>
   ]]></param>

And then just plug $emptyFieldWarning$ into the HTML module. But you're right if there are more than one or two keys to check this gets really tedious whereas a nullKeys feature as you describe would be a bit better.

0 Karma

snoobzilla
Builder

Awesome. Thanks for considering it and for valuesetter suggestion above.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...