Dashboards & Visualizations

How to implement an if/else condition in forms?

sfmandmdev
Path Finder

I have a form with a field called "Input" where a splunk user can type in a value-likeA,B,C etc. I want my form to run the search based on what the user inputs.

so, the logic should be:

if(input="X")
    then splunk search="index=!* index=*X...."
else
    splunk search="index=*..."

How can I enforce that condition in my forms? Thanks

Tags (1)

southeringtonp
Motivator

Maybe not quite what you're looking for, but have you considered changing from a free-form input to a dropdown menu?

You likely would have to use the Advanced XML syntax, but with that approach, you can have different fields for the label displayed to the user and the actual value passed to the search. So in the dropdown, the label would be X, but the "value" would be index=!* index=*X....

Once you have that, you can use stringreplace to insert that into your search string.

0 Karma

southeringtonp
Motivator

Fair enough. Just remember that you can use a search string to populate the list, so only the exception cases would necessarily require manual intervention.

0 Karma

sfmandmdev
Path Finder

I don't want to create a dropdown- because its a long and ever-changing list.Thanks though!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can probably do this by creating a macro for your search string (or a portion of your search string) and substituting in the form value to the macro argument.

0 Karma

sfmandmdev
Path Finder

Okay, say my macro is foo($arg$) where arg is either:(index!=X index=$input$) OR (index=$input$) depending on what the user enters(input is that value)

How , then, in my form do i specify this if/else condition?
if(input=X)
foo(index=$input$*)
if(input!=X)
foo(index!=*X index=$input$)

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...