Dashboards & Visualizations

Form Search Radio or Dropdown to select boolean AND or OR?

the_wolverine
Champion

Does anyone have an example on how this can be done? I'd like to add a dropdown for user to select "AND or OR" in a form search. Something like:

$user$ "Select AND or OR" $ip$ | head 1
0 Karma
1 Solution

the_wolverine
Champion

Providing an alternative answer where I allow user to choose AND/OR as boolean in my form. Also, by default, boolean will be set to OR:

  <module name="HiddenSearch" layoutPanel="viewHeader">
      <param name="search">index=main $user$ $andor$ $ip$ | head 10  </param>
    <module name="ExtendedFieldSearch">
      <param name="field">Username</param>
      <param name="replacementMap">
        <param name="arg">
          <param name="user">
              <param name="value"></param>
          </param>
        </param>
      </param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="user">
            <param name="fillOnEmpty">False</param>
            <param name="prefix">user=</param>
            <param name="suffix">*</param>
            <param name="default">"N/A"</param>
          </param>
        </param>
      </param>      

  <module name="StaticRadio">
  <param name="name">BooleanSelect</param>
  <param name="settingToCreate">andor</param>
  <param name="label">AND or OR</param>
    <param name="staticFieldsToDisplay">

    <list>
      <param name="label">OR</param>
      <param name="value">OR</param>
      <param name="default">OR</param>
    </list>
    <list>
      <param name="label">AND</param>
      <param name="value">AND</param>
    </list>
            </param>
            <param name="searchWhenChanged">False</param>
  <module name="ConvertToIntention">
    <param name="settingToConvert">andor</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="andor">
            <param name="fillOnEmpty">True</param>
            <param name="default">OR</param>
        <param name="value">$target$</param>
      </param>
    </param>
      </param>


        <module name="ExtendedFieldSearch">
          <param name="field">IP Address</param>
          <param name="replacementMap">
            <param name="arg">
              <param name="ip">
                <param name="value"></param>
              </param>
            </param>
          </param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="ip">
                <param name="fillOnEmpty">False</param>
                <param name="prefix">ip=</param>
                <param name="default">"N/A"</param>
              </param>
            </param>
          </param>

View solution in original post

0 Karma

the_wolverine
Champion

Providing an alternative answer where I allow user to choose AND/OR as boolean in my form. Also, by default, boolean will be set to OR:

  <module name="HiddenSearch" layoutPanel="viewHeader">
      <param name="search">index=main $user$ $andor$ $ip$ | head 10  </param>
    <module name="ExtendedFieldSearch">
      <param name="field">Username</param>
      <param name="replacementMap">
        <param name="arg">
          <param name="user">
              <param name="value"></param>
          </param>
        </param>
      </param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="user">
            <param name="fillOnEmpty">False</param>
            <param name="prefix">user=</param>
            <param name="suffix">*</param>
            <param name="default">"N/A"</param>
          </param>
        </param>
      </param>      

  <module name="StaticRadio">
  <param name="name">BooleanSelect</param>
  <param name="settingToCreate">andor</param>
  <param name="label">AND or OR</param>
    <param name="staticFieldsToDisplay">

    <list>
      <param name="label">OR</param>
      <param name="value">OR</param>
      <param name="default">OR</param>
    </list>
    <list>
      <param name="label">AND</param>
      <param name="value">AND</param>
    </list>
            </param>
            <param name="searchWhenChanged">False</param>
  <module name="ConvertToIntention">
    <param name="settingToConvert">andor</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="andor">
            <param name="fillOnEmpty">True</param>
            <param name="default">OR</param>
        <param name="value">$target$</param>
      </param>
    </param>
      </param>


        <module name="ExtendedFieldSearch">
          <param name="field">IP Address</param>
          <param name="replacementMap">
            <param name="arg">
              <param name="ip">
                <param name="value"></param>
              </param>
            </param>
          </param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="ip">
                <param name="fillOnEmpty">False</param>
                <param name="prefix">ip=</param>
                <param name="default">"N/A"</param>
              </param>
            </param>
          </param>
0 Karma

the_wolverine
Champion
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...