How can I vary the search template based on a token value in a form?

[tmccarty]

I have a form on which I'd like to run different search templates depending on the user input. For this particular problem, I'm working with DB Connect pulling data from summary tables, but we may have similar needs with log data running through Splunk in a more traditional manner as well.

Ex 1: Radio button input so the user can specify whether to present the results in summary, monthly, or weekly breakdowns. In this case, the search pulls from different pre-summarized tables depending upon the level of granularity applied.

Ex 2: Optional text field that if the user enters a value, an extra filter is applied to the search with the value of the field. If blank, the filter is not applied.

Is there any way to select which search template to run based on the value of a token?

We're currently running Splunk 6.0 and planning to upgrade to 6.1 shortly.

Thanks for any ideas you can offer.

[dfoster_splunk]

It looks like based on choices made in #1 and #2, you compute a new search string.

If you bind the radio button in #1 to $timePeriod$, the text field in #2 to $extraFilter$, and the search template to $computedSearch$, you could create a JS TokenForwarder that recomputes $computedSearch$ whenever #1 and #2 change.

For example:

require([
    "splunkjs/ready!",
    "splunkjs/mvc/tokenforwarder"
], function(mvc, TokenForwarder) {
    new TokenForwarder(
        ["$timePeriod$", "$extraFilter"],
        "$computedSearch$",
        function(timePeriod, extraFilter) {
            var computedSearch;
            if (timePeriod === 'summary') {
                computedSearch = ...
            } else if (timePeriod === 'monthly') {
                computedSearch = ...
            } else if (timePeriod === 'weekly') {
                computedSearch = ...
            }

            if (extraFilter !== '') {
                computedSearch += ' | search ' + extraFilter;
            }

            return computedSearch;
        }
    );
});

More details on transforming and validating tokens here:
http://dev.splunk.com/view/SP-CAAAEW4

[tmccarty]

This sounds like exactly what I need. I'll check it out - thanks!

[dwaddle]

I think both of your examples are pretty easy using Sideview Utils. Your example #2 there is a classic case of SVU's template= parameter that lets you completely omit form search fields from the dispatched search if the form search data entry field is empty. Check out the newest release of Sideview Utils (with extensive examples) at http://sideviewapps.com/apps/sideview-utils/

[tmccarty]

Thanks for the tip - I've installed Sideview Utils and am looking at it now.