Dashboards & Visualizations

Form Search Radio or Dropdown to select boolean AND or OR?

the_wolverine
Champion

Does anyone have an example on how this can be done? I'd like to add a dropdown for user to select "AND or OR" in a form search. Something like:

$user$ "Select AND or OR" $ip$ | head 1
0 Karma
1 Solution

the_wolverine
Champion

Providing an alternative answer where I allow user to choose AND/OR as boolean in my form. Also, by default, boolean will be set to OR:

  <module name="HiddenSearch" layoutPanel="viewHeader">
      <param name="search">index=main $user$ $andor$ $ip$ | head 10  </param>
    <module name="ExtendedFieldSearch">
      <param name="field">Username</param>
      <param name="replacementMap">
        <param name="arg">
          <param name="user">
              <param name="value"></param>
          </param>
        </param>
      </param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="user">
            <param name="fillOnEmpty">False</param>
            <param name="prefix">user=</param>
            <param name="suffix">*</param>
            <param name="default">"N/A"</param>
          </param>
        </param>
      </param>      

  <module name="StaticRadio">
  <param name="name">BooleanSelect</param>
  <param name="settingToCreate">andor</param>
  <param name="label">AND or OR</param>
    <param name="staticFieldsToDisplay">

    <list>
      <param name="label">OR</param>
      <param name="value">OR</param>
      <param name="default">OR</param>
    </list>
    <list>
      <param name="label">AND</param>
      <param name="value">AND</param>
    </list>
            </param>
            <param name="searchWhenChanged">False</param>
  <module name="ConvertToIntention">
    <param name="settingToConvert">andor</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="andor">
            <param name="fillOnEmpty">True</param>
            <param name="default">OR</param>
        <param name="value">$target$</param>
      </param>
    </param>
      </param>


        <module name="ExtendedFieldSearch">
          <param name="field">IP Address</param>
          <param name="replacementMap">
            <param name="arg">
              <param name="ip">
                <param name="value"></param>
              </param>
            </param>
          </param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="ip">
                <param name="fillOnEmpty">False</param>
                <param name="prefix">ip=</param>
                <param name="default">"N/A"</param>
              </param>
            </param>
          </param>

View solution in original post

0 Karma

the_wolverine
Champion

Providing an alternative answer where I allow user to choose AND/OR as boolean in my form. Also, by default, boolean will be set to OR:

  <module name="HiddenSearch" layoutPanel="viewHeader">
      <param name="search">index=main $user$ $andor$ $ip$ | head 10  </param>
    <module name="ExtendedFieldSearch">
      <param name="field">Username</param>
      <param name="replacementMap">
        <param name="arg">
          <param name="user">
              <param name="value"></param>
          </param>
        </param>
      </param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="user">
            <param name="fillOnEmpty">False</param>
            <param name="prefix">user=</param>
            <param name="suffix">*</param>
            <param name="default">"N/A"</param>
          </param>
        </param>
      </param>      

  <module name="StaticRadio">
  <param name="name">BooleanSelect</param>
  <param name="settingToCreate">andor</param>
  <param name="label">AND or OR</param>
    <param name="staticFieldsToDisplay">

    <list>
      <param name="label">OR</param>
      <param name="value">OR</param>
      <param name="default">OR</param>
    </list>
    <list>
      <param name="label">AND</param>
      <param name="value">AND</param>
    </list>
            </param>
            <param name="searchWhenChanged">False</param>
  <module name="ConvertToIntention">
    <param name="settingToConvert">andor</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="andor">
            <param name="fillOnEmpty">True</param>
            <param name="default">OR</param>
        <param name="value">$target$</param>
      </param>
    </param>
      </param>


        <module name="ExtendedFieldSearch">
          <param name="field">IP Address</param>
          <param name="replacementMap">
            <param name="arg">
              <param name="ip">
                <param name="value"></param>
              </param>
            </param>
          </param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="ip">
                <param name="fillOnEmpty">False</param>
                <param name="prefix">ip=</param>
                <param name="default">"N/A"</param>
              </param>
            </param>
          </param>
0 Karma

the_wolverine
Champion
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...