Splunk Dev

Conditional Switcher not working

john
Communicator

Hi,
i want to switch the searches on the basis of token value from
dropdown. This is my conditional module its always showing only the value of second hidden search irrespective of condition.Please tell what iam missing here.


independent
(context.get("series")=="ERROR")


index="logs" ERROR


index="logs" Exception


Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

The problem is that the StaticRadio is sending down a context key called "series_setting". While that key is then being turned into a stringreplace intention by the name of "series", the context key itself is "series_setting", not "series".

So what you need to do is change context.get("series") to context.get("series_setting").
(or you could go the other way and change all the "series_setting" values to just "series".)

Intentions leave plenty of room for confusion. You might look at Sideview Utils because it does a lot of things to simplify view creation, not least of which is that you never have to use or think about intentions again...

john
Communicator

Thanks,Now its working

0 Karma

john
Communicator

hi melting,

I have done the changes you suggested.But there is no reflection on the dashboard.It is still executing the second search only

0 Karma

john
Communicator

This is my full view


myRadio
series_setting
field:


ERROR
ERROR


Ecxeption
Exception



series_setting

stringreplace


apache_error
$target$




independent
(context.get("series")=="ERROR")


index="logs" ERROR


index="logs" Exception


</module>


0 Karma

sideview
SplunkTrust
SplunkTrust

Can you include the modules upstream from the ConditionalSwitcher? The Switcher is getting the "series" value from the context, which presumably means some module upstream is putting in a "series" key. If you include the upstream modules then we can verify that the upstream part is as it should be.

melting
Splunk Employee
Splunk Employee

Without knowing your full view. The conditional switcher has some debug logging in it, so you could turn on logging and see the results in your browser's console.

If you want to turn on browser logging:
in $SPLUNK_HOME/etc/log.cfg python stanza
change all values to DEBUG
In web.conf settings stanza
js_logger_mode = Firebug

After turning logging on you will see messages like:
Splunk.Module.ConditionalSwitcher evaluating ...

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...