How to implement an if/else condition in forms?

[sfmandmdev]

I have a form with a field called "Input" where a splunk user can type in a value-likeA,B,C etc. I want my form to run the search based on what the user inputs.

so, the logic should be:

if(input="X")
    then splunk search="index=!* index=*X...."
else
    splunk search="index=*..."

How can I enforce that condition in my forms? Thanks

[southeringtonp]

Maybe not quite what you're looking for, but have you considered changing from a free-form input to a dropdown menu?

You likely would have to use the Advanced XML syntax, but with that approach, you can have different fields for the label displayed to the user and the actual value passed to the search. So in the dropdown, the label would be X, but the "value" would be index=!* index=*X....

Once you have that, you can use stringreplace to insert that into your search string.

[southeringtonp]

Fair enough. Just remember that you can use a search string to populate the list, so only the exception cases would necessarily require manual intervention.

[sfmandmdev]

I don't want to create a dropdown- because its a long and ever-changing list.Thanks though!

[gkanapathy]

You can probably do this by creating a macro for your search string (or a portion of your search string) and substituting in the form value to the macro argument.

[sfmandmdev]

Okay, say my macro is foo($arg$) where arg is either:(index!=X index=$input$) OR (index=$input$) depending on what the user enters(input is that value)

How , then, in my form do i specify this if/else condition?
if(input=X)
foo(index=$input$*)
if(input!=X)
foo(index!=*X index=$input$)