Dashboards & Visualizations

Using 2 RADIOBUTTONS and using them in the query

abhinav_aashish
Explorer

I'm having 3 indexes A(SUPER-SET),  B(SUBSET-1),  C(SUBSET-2).

I'm having 2 radio button groups: Group1 and Group2

 

Group1 has 2 options: YES and NO

When "YES" is selected then it performs A intersection B and "NO" does not perform any search.

 

Group2 has 2 options: YES and NO

When "YES" is selected then it performs A intersection C "NO" does not perform any search.

 

I'm having the following SOURCE CODE for it :

 

 

 

      <input type="radio" token="field1" searchWhenChanged="true">
        <label>Present in AB</label>
        <choice value="Yes">Yes</choice>
        <choice value="No">No</choice>
        <change>
          <condition value="Yes">
            <set token="mysearch">
                index=a   .....................
                | join <common_column> type=outer [| search index= B]
                | where check_column_value="BBBBBBBBBBB"
                | table <list of columns>
            </set>
          </condition>
          <condition value="No">
            <set token="mysearch"></set>
          </condition>
        </change>
      </input>




      <input type="radio" token="field2" searchWhenChanged="true">
        <label>Present in AC</label>
        <choice value="Yes">Yes</choice>
        <choice value="No">No</choice>
        <change>
          <condition value="Yes">
            <set token="mysearch">
                index=a   .....................
                | join <common_column> type=outer [| search index= C]
                | where check_column_value="CCCCCCCCCCCC"
                | table <list of columns>
            </set>
          </condition>
          <condition value="No">
            <set token="mysearch"></set>
          </condition>
        </change>
      </input>




      <table>
        <search>
          <query>$mysearch$</query>
        </search>
      </table>

 

 

 

 

 

When i click on YES buttons for the two groups :

abhinav_aashish_0-1621419891211.png

 

When I select both the YES options the result I get is from the index which is last selected as YES option only, i.e. in any case i'm not getting the result from both the sources even after selecting "YES" option.

I feel there is some issue with the token value in the last part of the code shared above.(Not sure!!)

 

Can anyone help me with this please?

Thanks

Labels (5)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You haven't understood the question. I was asking if you wanted "Keep B or C" or "Keep B and C". Nor have you clarified whether check_column_value is the same field in both B and C. Having said that, if you want to use the settings from both radio button groups, you could do something like this to set the mysearch token appropriately:

    <input type="radio" token="radioB" searchWhenChanged="true">
      <label>Present in AB</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <change>
        <condition value="Yes">
          <set token="joinB">| join common_column type=outer [| search index= B]</set>
          <set token="whereB">check_column_value="BBBBBBBBBBB"</set>
          <eval token="whereBC">if($whereC$="","| where ".$whereB$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinB"></set>
          <set token="whereB"></set>
          <eval token="whereBC">if($whereC$="","","| where ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <input type="radio" token="radioC" searchWhenChanged="true">
      <label>Present in AC</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <change>
        <condition value="Yes">
          <set token="joinC">| join common_column type=outer [| search index= C]</set>
          <set token="whereC">check_column_value="CCCCCCCCCCCC"</set>
          <eval token="whereBC">if($whereB$="","| where ".$whereC$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinC"></set>
          <set token="whereC"></set>
          <eval token="whereBC">if($whereB$="","","| where ".$whereB$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <html>
      <pre>$mysearch$</pre>
    </html>

View solution in original post

abhinav_aashish
Explorer

Thanks man it worked.

Instead of this

 

 

<set token="whereB">check_column_value="BBBBBBBBBBB"</set>

 

 

 

I was doing

 

 

<set token="whereB">| where check_column_value="BBBBBBBBBBB"</set>

 

 

 

This "| where" thing here was creating issues.

Thanks for the help.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please carefully check for any typos / mis-copies of code as this works for me - this is what is generated for me

index=a   .....................
| join common_column type=outer [| search index= B]
| join common_column type=outer [| search index= C]
| where check_column_value="BBBBBBBBBBB" OR check_column_value="CCCCCCCCCCCC"
| table list of columns
0 Karma

abhinav_aashish
Explorer

My code works properly when done without the use of radio buttons and I've applied the same logic.

I'm facing the issue with the use of 2 radio button groups.

Also I wanted the result this way:

Join fieldField match from BField match from CKeep B or C

Keep B and C

A CCCCCCCCCCCCYN
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...