Dashboards & Visualizations

Form Search Radio or Dropdown to select boolean AND or OR?

the_wolverine
Champion

Does anyone have an example on how this can be done? I'd like to add a dropdown for user to select "AND or OR" in a form search. Something like:

$user$ "Select AND or OR" $ip$ | head 1
0 Karma
1 Solution

the_wolverine
Champion

Providing an alternative answer where I allow user to choose AND/OR as boolean in my form. Also, by default, boolean will be set to OR:

  <module name="HiddenSearch" layoutPanel="viewHeader">
      <param name="search">index=main $user$ $andor$ $ip$ | head 10  </param>
    <module name="ExtendedFieldSearch">
      <param name="field">Username</param>
      <param name="replacementMap">
        <param name="arg">
          <param name="user">
              <param name="value"></param>
          </param>
        </param>
      </param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="user">
            <param name="fillOnEmpty">False</param>
            <param name="prefix">user=</param>
            <param name="suffix">*</param>
            <param name="default">"N/A"</param>
          </param>
        </param>
      </param>      

  <module name="StaticRadio">
  <param name="name">BooleanSelect</param>
  <param name="settingToCreate">andor</param>
  <param name="label">AND or OR</param>
    <param name="staticFieldsToDisplay">

    <list>
      <param name="label">OR</param>
      <param name="value">OR</param>
      <param name="default">OR</param>
    </list>
    <list>
      <param name="label">AND</param>
      <param name="value">AND</param>
    </list>
            </param>
            <param name="searchWhenChanged">False</param>
  <module name="ConvertToIntention">
    <param name="settingToConvert">andor</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="andor">
            <param name="fillOnEmpty">True</param>
            <param name="default">OR</param>
        <param name="value">$target$</param>
      </param>
    </param>
      </param>


        <module name="ExtendedFieldSearch">
          <param name="field">IP Address</param>
          <param name="replacementMap">
            <param name="arg">
              <param name="ip">
                <param name="value"></param>
              </param>
            </param>
          </param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="ip">
                <param name="fillOnEmpty">False</param>
                <param name="prefix">ip=</param>
                <param name="default">"N/A"</param>
              </param>
            </param>
          </param>

View solution in original post

0 Karma

the_wolverine
Champion

Providing an alternative answer where I allow user to choose AND/OR as boolean in my form. Also, by default, boolean will be set to OR:

  <module name="HiddenSearch" layoutPanel="viewHeader">
      <param name="search">index=main $user$ $andor$ $ip$ | head 10  </param>
    <module name="ExtendedFieldSearch">
      <param name="field">Username</param>
      <param name="replacementMap">
        <param name="arg">
          <param name="user">
              <param name="value"></param>
          </param>
        </param>
      </param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="user">
            <param name="fillOnEmpty">False</param>
            <param name="prefix">user=</param>
            <param name="suffix">*</param>
            <param name="default">"N/A"</param>
          </param>
        </param>
      </param>      

  <module name="StaticRadio">
  <param name="name">BooleanSelect</param>
  <param name="settingToCreate">andor</param>
  <param name="label">AND or OR</param>
    <param name="staticFieldsToDisplay">

    <list>
      <param name="label">OR</param>
      <param name="value">OR</param>
      <param name="default">OR</param>
    </list>
    <list>
      <param name="label">AND</param>
      <param name="value">AND</param>
    </list>
            </param>
            <param name="searchWhenChanged">False</param>
  <module name="ConvertToIntention">
    <param name="settingToConvert">andor</param>
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="andor">
            <param name="fillOnEmpty">True</param>
            <param name="default">OR</param>
        <param name="value">$target$</param>
      </param>
    </param>
      </param>


        <module name="ExtendedFieldSearch">
          <param name="field">IP Address</param>
          <param name="replacementMap">
            <param name="arg">
              <param name="ip">
                <param name="value"></param>
              </param>
            </param>
          </param>
          <param name="intention">
            <param name="name">stringreplace</param>
            <param name="arg">
              <param name="ip">
                <param name="fillOnEmpty">False</param>
                <param name="prefix">ip=</param>
                <param name="default">"N/A"</param>
              </param>
            </param>
          </param>
0 Karma

the_wolverine
Champion
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...