Dashboards & Visualizations

Using 2 RADIOBUTTONS and using them in the query

abhinav_aashish
Explorer

I'm having 3 indexes A(SUPER-SET),  B(SUBSET-1),  C(SUBSET-2).

I'm having 2 radio button groups: Group1 and Group2

 

Group1 has 2 options: YES and NO

When "YES" is selected then it performs A intersection B and "NO" does not perform any search.

 

Group2 has 2 options: YES and NO

When "YES" is selected then it performs A intersection C "NO" does not perform any search.

 

I'm having the following SOURCE CODE for it :

 

 

 

      <input type="radio" token="field1" searchWhenChanged="true">
        <label>Present in AB</label>
        <choice value="Yes">Yes</choice>
        <choice value="No">No</choice>
        <change>
          <condition value="Yes">
            <set token="mysearch">
                index=a   .....................
                | join <common_column> type=outer [| search index= B]
                | where check_column_value="BBBBBBBBBBB"
                | table <list of columns>
            </set>
          </condition>
          <condition value="No">
            <set token="mysearch"></set>
          </condition>
        </change>
      </input>




      <input type="radio" token="field2" searchWhenChanged="true">
        <label>Present in AC</label>
        <choice value="Yes">Yes</choice>
        <choice value="No">No</choice>
        <change>
          <condition value="Yes">
            <set token="mysearch">
                index=a   .....................
                | join <common_column> type=outer [| search index= C]
                | where check_column_value="CCCCCCCCCCCC"
                | table <list of columns>
            </set>
          </condition>
          <condition value="No">
            <set token="mysearch"></set>
          </condition>
        </change>
      </input>




      <table>
        <search>
          <query>$mysearch$</query>
        </search>
      </table>

 

 

 

 

 

When i click on YES buttons for the two groups :

abhinav_aashish_0-1621419891211.png

 

When I select both the YES options the result I get is from the index which is last selected as YES option only, i.e. in any case i'm not getting the result from both the sources even after selecting "YES" option.

I feel there is some issue with the token value in the last part of the code shared above.(Not sure!!)

 

Can anyone help me with this please?

Thanks

Labels (5)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You haven't understood the question. I was asking if you wanted "Keep B or C" or "Keep B and C". Nor have you clarified whether check_column_value is the same field in both B and C. Having said that, if you want to use the settings from both radio button groups, you could do something like this to set the mysearch token appropriately:

    <input type="radio" token="radioB" searchWhenChanged="true">
      <label>Present in AB</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <change>
        <condition value="Yes">
          <set token="joinB">| join common_column type=outer [| search index= B]</set>
          <set token="whereB">check_column_value="BBBBBBBBBBB"</set>
          <eval token="whereBC">if($whereC$="","| where ".$whereB$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinB"></set>
          <set token="whereB"></set>
          <eval token="whereBC">if($whereC$="","","| where ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <input type="radio" token="radioC" searchWhenChanged="true">
      <label>Present in AC</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <change>
        <condition value="Yes">
          <set token="joinC">| join common_column type=outer [| search index= C]</set>
          <set token="whereC">check_column_value="CCCCCCCCCCCC"</set>
          <eval token="whereBC">if($whereB$="","| where ".$whereC$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinC"></set>
          <set token="whereC"></set>
          <eval token="whereBC">if($whereB$="","","| where ".$whereB$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <html>
      <pre>$mysearch$</pre>
    </html>

View solution in original post

abhinav_aashish
Explorer

Thanks man it worked.

Instead of this

 

 

<set token="whereB">check_column_value="BBBBBBBBBBB"</set>

 

 

 

I was doing

 

 

<set token="whereB">| where check_column_value="BBBBBBBBBBB"</set>

 

 

 

This "| where" thing here was creating issues.

Thanks for the help.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please carefully check for any typos / mis-copies of code as this works for me - this is what is generated for me

index=a   .....................
| join common_column type=outer [| search index= B]
| join common_column type=outer [| search index= C]
| where check_column_value="BBBBBBBBBBB" OR check_column_value="CCCCCCCCCCCC"
| table list of columns
0 Karma

abhinav_aashish
Explorer

My code works properly when done without the use of radio buttons and I've applied the same logic.

I'm facing the issue with the use of 2 radio button groups.

Also I wanted the result this way:

Join fieldField match from BField match from CKeep B or C

Keep B and C

A CCCCCCCCCCCCYN
0 Karma
Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...