Dashboards & Visualizations

Using 2 RADIOBUTTONS and using them in the query

abhinav_aashish
Explorer

I'm having 3 indexes A(SUPER-SET),  B(SUBSET-1),  C(SUBSET-2).

I'm having 2 radio button groups: Group1 and Group2

 

Group1 has 2 options: YES and NO

When "YES" is selected then it performs A intersection B and "NO" does not perform any search.

 

Group2 has 2 options: YES and NO

When "YES" is selected then it performs A intersection C "NO" does not perform any search.

 

I'm having the following SOURCE CODE for it :

 

 

 

      <input type="radio" token="field1" searchWhenChanged="true">
        <label>Present in AB</label>
        <choice value="Yes">Yes</choice>
        <choice value="No">No</choice>
        <change>
          <condition value="Yes">
            <set token="mysearch">
                index=a   .....................
                | join <common_column> type=outer [| search index= B]
                | where check_column_value="BBBBBBBBBBB"
                | table <list of columns>
            </set>
          </condition>
          <condition value="No">
            <set token="mysearch"></set>
          </condition>
        </change>
      </input>




      <input type="radio" token="field2" searchWhenChanged="true">
        <label>Present in AC</label>
        <choice value="Yes">Yes</choice>
        <choice value="No">No</choice>
        <change>
          <condition value="Yes">
            <set token="mysearch">
                index=a   .....................
                | join <common_column> type=outer [| search index= C]
                | where check_column_value="CCCCCCCCCCCC"
                | table <list of columns>
            </set>
          </condition>
          <condition value="No">
            <set token="mysearch"></set>
          </condition>
        </change>
      </input>




      <table>
        <search>
          <query>$mysearch$</query>
        </search>
      </table>

 

 

 

 

 

When i click on YES buttons for the two groups :

abhinav_aashish_0-1621419891211.png

 

When I select both the YES options the result I get is from the index which is last selected as YES option only, i.e. in any case i'm not getting the result from both the sources even after selecting "YES" option.

I feel there is some issue with the token value in the last part of the code shared above.(Not sure!!)

 

Can anyone help me with this please?

Thanks

Labels (5)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You haven't understood the question. I was asking if you wanted "Keep B or C" or "Keep B and C". Nor have you clarified whether check_column_value is the same field in both B and C. Having said that, if you want to use the settings from both radio button groups, you could do something like this to set the mysearch token appropriately:

    <input type="radio" token="radioB" searchWhenChanged="true">
      <label>Present in AB</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <change>
        <condition value="Yes">
          <set token="joinB">| join common_column type=outer [| search index= B]</set>
          <set token="whereB">check_column_value="BBBBBBBBBBB"</set>
          <eval token="whereBC">if($whereC$="","| where ".$whereB$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinB"></set>
          <set token="whereB"></set>
          <eval token="whereBC">if($whereC$="","","| where ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <input type="radio" token="radioC" searchWhenChanged="true">
      <label>Present in AC</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <change>
        <condition value="Yes">
          <set token="joinC">| join common_column type=outer [| search index= C]</set>
          <set token="whereC">check_column_value="CCCCCCCCCCCC"</set>
          <eval token="whereBC">if($whereB$="","| where ".$whereC$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinC"></set>
          <set token="whereC"></set>
          <eval token="whereBC">if($whereB$="","","| where ".$whereB$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <html>
      <pre>$mysearch$</pre>
    </html>

View solution in original post

abhinav_aashish
Explorer

Thanks man it worked.

Instead of this

 

 

<set token="whereB">check_column_value="BBBBBBBBBBB"</set>

 

 

 

I was doing

 

 

<set token="whereB">| where check_column_value="BBBBBBBBBBB"</set>

 

 

 

This "| where" thing here was creating issues.

Thanks for the help.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please carefully check for any typos / mis-copies of code as this works for me - this is what is generated for me

index=a   .....................
| join common_column type=outer [| search index= B]
| join common_column type=outer [| search index= C]
| where check_column_value="BBBBBBBBBBB" OR check_column_value="CCCCCCCCCCCC"
| table list of columns
0 Karma

abhinav_aashish
Explorer

My code works properly when done without the use of radio buttons and I've applied the same logic.

I'm facing the issue with the use of 2 radio button groups.

Also I wanted the result this way:

Join fieldField match from BField match from CKeep B or C

Keep B and C

A CCCCCCCCCCCCYN
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...