Using 2 RADIOBUTTONS and using them in the query

[abhinav_aashish]

I'm having 3 indexes A(SUPER-SET),  B(SUBSET-1),  C(SUBSET-2).

I'm having 2 radio button groups: Group1 and Group2

Group1 has 2 options: YES and NO

When "YES" is selected then it performs A intersection B and "NO" does not perform any search.

Group2 has 2 options: YES and NO

When "YES" is selected then it performs A intersection C "NO" does not perform any search.

I'm having the following SOURCE CODE for it :

      <input type="radio" token="field1" searchWhenChanged="true">
        <label>Present in AB</label>
        <choice value="Yes">Yes</choice>
        <choice value="No">No</choice>
        <change>
          <condition value="Yes">
            <set token="mysearch">
                index=a   .....................
                | join <common_column> type=outer [| search index= B]
                | where check_column_value="BBBBBBBBBBB"
                | table <list of columns>
            </set>
          </condition>
          <condition value="No">
            <set token="mysearch"></set>
          </condition>
        </change>
      </input>




      <input type="radio" token="field2" searchWhenChanged="true">
        <label>Present in AC</label>
        <choice value="Yes">Yes</choice>
        <choice value="No">No</choice>
        <change>
          <condition value="Yes">
            <set token="mysearch">
                index=a   .....................
                | join <common_column> type=outer [| search index= C]
                | where check_column_value="CCCCCCCCCCCC"
                | table <list of columns>
            </set>
          </condition>
          <condition value="No">
            <set token="mysearch"></set>
          </condition>
        </change>
      </input>




      <table>
        <search>
          <query>$mysearch$</query>
        </search>
      </table>

When i click on YES buttons for the two groups :

When I select both the YES options the result I get is from the index which is last selected as YES option only, i.e. in any case i'm not getting the result from both the sources even after selecting "YES" option.

I feel there is some issue with the token value in the last part of the code shared above.(Not sure!!)

Can anyone help me with this please?

Thanks

[ITWhisperer]

You haven't defined what both set to yes means - Why not have one group with 3, or 4 or 5 values, A, A intersect B, A intersect C, A intersect (B intersect C), A intersect (B union C)? That way you can define your searches exactly as you would like for each case.

[abhinav_aashish]

Sorry. I'm unable to get this.

[ITWhisperer]

B is a subset of A, C is a different subset of A. Do these subsets overlap? When you select Yes from both radio button groups, do you want to search for those in A and (B or C), or those in A and (B and C). These are potentially two different things.

[abhinav_aashish]

Yes these two subsets overlap.

I want to get the field values from index=A when YES is selected as per match condition.

[ITWhisperer]

That still doesn't answer the question - what do you want when both yes boxes are selected? If the check column is different as returned by the joins

Join field	Field match from B	Field match from C	Keep B or C	Keep B and C
A			N	N
A	BBBBBBBBBBB		Y	N
A		CCCCCCCCCCCC	Y	N
A	BBBBBBBBBBB	CCCCCCCCCCCC	Y	Y

If these columns are the same (as possibly indicated in your example) then when both boxes are yes, your search might be something like

index=a   .....................
| join <common_column> type=outer [| search index= B]
| join <common_column> type=outer [| search index= C]
| where check_column_value="BBBBBBBBBBB" OR check_column_value="CCCCCCCCCCCC"
| table <list of columns>

[abhinav_aashish]

I want this in the output

"

A

BBBBBBBBBBB

CCCCCCCCCCCC

Y

Y

[ITWhisperer · Accepted solution]

You haven't understood the question. I was asking if you wanted "Keep B or C" or "Keep B and C". Nor have you clarified whether check_column_value is the same field in both B and C. Having said that, if you want to use the settings from both radio button groups, you could do something like this to set the mysearch token appropriately:

    <input type="radio" token="radioB" searchWhenChanged="true">
      <label>Present in AB</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <change>
        <condition value="Yes">
          <set token="joinB">| join common_column type=outer [| search index= B]</set>
          <set token="whereB">check_column_value="BBBBBBBBBBB"</set>
          <eval token="whereBC">if($whereC$="","| where ".$whereB$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinB"></set>
          <set token="whereB"></set>
          <eval token="whereBC">if($whereC$="","","| where ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <input type="radio" token="radioC" searchWhenChanged="true">
      <label>Present in AC</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <change>
        <condition value="Yes">
          <set token="joinC">| join common_column type=outer [| search index= C]</set>
          <set token="whereC">check_column_value="CCCCCCCCCCCC"</set>
          <eval token="whereBC">if($whereB$="","| where ".$whereC$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinC"></set>
          <set token="whereC"></set>
          <eval token="whereBC">if($whereB$="","","| where ".$whereB$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <html>
      <pre>$mysearch$</pre>
    </html>

[abhinav_aashish]

There are some changes in the ask.

When I select "NO" from group-1 it should omit the rows from B index and similarly for group-2 it should omit the rows from C index when I select "NO".

And when "NO " is selected from both the groups it should return the rows from A which are not present in both B and C.

I tried few things by adding in the

<condition value="No">
          <set token="joinB">| join common_column type=outer [| search index= B]</set>
          <set token="whereB">check_column_value !="BBBBBBBBBBB"</set>
          <eval token="whereBC">if($whereC$="","| where ".$whereB$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>

 for both the button groups but I wasn't getting satisfactory results.

[ITWhisperer]

I think the OR should probably be AND for the No change handlers, i.e. check_column_value != "BBB" AND check_column_value = "CCC" if yes was chosen for C, or check_column_value != "BBB" AND check_column_value != "CCC" if no was chosen for C. Similarly for the C change handler.

[abhinav_aashish]

Wont the above code return the fields from A as well when YES is selected?

The NO and NO works fine now but the YES-NO combinations does not give correct result.

[ITWhisperer]

Yes, it is getting a bit messy. Essentially, you are probably going to need another couple of tokens. The if $whereC$ = "" condition will no longer be good enough to be able to know whether no or yes has been selected for the C radio buttons since this token is not going to be blank but could be set to check="CC" or check!="CC". Similarly, for the B token. Depending on whether either is set to != the where condition needs AND, if both are set to = then OR is required. Having said that, since you are now checking for BB and CC being present or absent, you are going to need both joins, so that bit is slightly simpler. This is different to the original problem, so are you sure it is what you want now?

[abhinav_aashish]

See what I need is

yes(g1) and yes(g2) ---> return the common rows from B and C both (keep either of them in the result) where a match occurs based on a column

yes(g1) and no(g2) ---> return the common rows from B and not include C where a match occurs based on a column

no(g1) and yes(g2) ---> return the common rows from C and not include B where a match occurs based on a column

no(g1) and no(g2) ---> return the rows from A which are not present in both B and C

[ITWhisperer]

    <input type="radio" token="radioB" searchWhenChanged="true">
      <label>Present in AB</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <default>Yes</default>
      <change>
        <condition value="Yes">
          <set token="joinB">| join common_column type=outer [| search index= B]</set>
          <set token="whereB">check_column_value="BBBBBBBBBBB"</set>
          <set token="whereNotB"></set>
          <eval token="whereBC">if($whereC$="","| where ".$whereB$." AND ".$whereNotC$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinB">| join common_column type=outer [| search index= B]</set>
          <set token="whereB"></set>
          <set token="whereNotB">check_column_value!="BBBBBBBBBBB"</set>
          <eval token="whereBC">if($whereC$="","| where ".$whereNotB$." AND ".$whereNotC$,"| where ".$whereNotB$." AND ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <input type="radio" token="radioC" searchWhenChanged="true">
      <label>Present in AC</label>
      <choice value="Yes">Yes</choice>
      <choice value="No">No</choice>
      <default>Yes</default>
      <change>
        <condition value="Yes">
          <set token="joinC">| join common_column type=outer [| search index= C]</set>
          <set token="whereC">check_column_value="CCCCCCCCCCCC"</set>
          <set token="whereNotC"></set>
          <eval token="whereBC">if($whereB$="","| where ".$whereNotB$." AND ".$whereC$,"| where ".$whereB$." OR ".$whereC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
        <condition value="No">
          <set token="joinC">| join common_column type=outer [| search index= C]</set>
          <set token="whereC"></set>
          <set token="whereNotC">check_column_value!="CCCCCCCCCCCC"</set>
          <eval token="whereBC">if($whereB$="","| where ".$whereNotB$." AND ".$whereNotC$,"| where ".$whereB$." AND ".$whereNotC$)</eval>
          <set token="mysearch">
index=a   .....................
$joinB$
$joinC$
$whereBC$
| table list of columns
          </set>
        </condition>
      </change>
    </input>
    <html>
      <pre>$mysearch$</pre>
    </html>

[abhinav_aashish]

Thanks man for your help.

[abhinav_aashish]

I implemented your code but when I select YES in bot the radio button groups I get the following error:

 Error in 'where' command: The expression is malformed. An 'OR' term is missing. 

[ITWhisperer]

Can you share what you implemented?

[abhinav_aashish]

I cant share those details. I implemented exactly the same as you wrote above.

[ITWhisperer]

OK try setting a default for both radio button groups

[abhinav_aashish]

Not working.

<default>Yes</default>

The combination on Yes(g1) and No(g2) and vice-versa works.

Also No(g1) and No(g2) works fine.

i want the result I clarified

Join field

Field match from B

Field match from C

Keep B or C

Keep B and C

A

CCCCCCCCCCCC

Y

N

I'm sorry for too many edits.

[ITWhisperer]

I suggest you temporarily add an html panel as I showed so you can see what they search expands to and see if you can spot what might be wrong with it. Or perhaps even copy it to the search and try and debug it there.