xml: Multiple change blocks in input

[weidertc]

I have a dropdown input with multiple <change> tags. I need to do two things: 1) set a token based on the value of the dropdown, and 2) set the value of another dropdown based on the value of the current one. If i put the change block that sets the token first, then the 2nd dropdown value doesn't update. If i put the change block that sets the value of the 2nd dropdown, my token isn't set. I can only get one or the other based on the order of the change blocks.

<change>
    <condition match="'value' == &quot;4.1.1&quot; OR 'value' == &quot;4.1.2&quot;">
      <set token="showPanel">true</set>
    </condition>
    <condition>
      <unset token="showPanel"></unset>
    </condition>
  </change>
  <change>
    <condition match="$value$ == &quot;None&quot;">
      <set token="form.input2">None</set>
    </condition>
    <condition match="$value$ != &quot;None&quot;">
      <set token="form.input2">%</set>
    </condition>
  </change>

I tried just merging them into a single change block but I get the same result. It seems to quit out at the first match from both the condition and all additional changes i need to make happen.

how can i get both?

Chris

[niketn · Accepted solution]

@weidertc when you merged the conditions did you try the following?

   <change>
     <condition match="$value$ == &quot;4.1.1&quot; OR $value$ == &quot;4.1.2&quot;">
       <set token="showPanel">true</set>
       <set token="form.input2">%</set>
     </condition>
     <condition match="$value$ == &quot;None&quot;">
       <set token="form.input2">None</set>
       <unset token="showPanel"></unset>
     </condition>
     <condition match="$value$ != &quot;None&quot;">
       <set token="form.input2">%</set>
       <unset token="showPanel"></unset>
     </condition>
     <condition>
       <unset token="showPanel"></unset>
     </condition>
   </change>

[weidertc]

thanks, this works. I don't think I can escape having an ever increasing list of conditions when new panels get added, but this looks doable. I get to keep them all on a single input dropdown.

I added a condition so "All" will work, based on the value of another dropdown (the one higher up in the hierarchy)

  <change>
    <condition match="('value' == &quot;%&quot; AND $field3$ == &quot;4.1&quot;) OR 'value' == &quot;4.1.1&quot; OR 'value' == &quot;4.1.2&quot;">
      <set token="form.field4">%</set>
      <set token="showPanel">true</set>
    </condition>
    <condition match="$value$ == &quot;None&quot;">
      <set token="form.field4">None</set>
      <unset token="showPanel"></unset>
    </condition>
    <condition match="$value$ != &quot;None&quot;">
      <set token="form.field4">%</set>
      <unset token="showPanel"></unset>
    </condition>
    <condition>
      <unset token="showPanel"></unset>
    </condition>
  </change>

[niketn]

@weidertc you can explore the following two alternatives:

1) Use SplunkJS with JavaScript Change Handler on Token Model to apply your custom logic in JavaScript to have more code like control.
PS: This will be complicated to implement require you to be aware of JavaScript, Simple XML JS Extension and Splunk JS Stack. Refer to documentation: http://dev.splunk.com/view/SP-CAAAEW4

2) Use an independent search with | makeresults | eval dropdownValue=$yourDropDownTokenValue$ .... to use SPL to get the values of all the Input selections and use eval with case() function to set the token values accordingly. Finally use search event handler to set/unset required tokens based on values set in SPL.
PS: This will require conversion of your tokens and requirement into SPL (should not be big of a deal). But will add one additional search to your dashboard (should run fast though as it is not pulling transactional data from index or any other data source).

In case you do run into an issue where too many conditions are too complicated to be formed inside input's change event handler, you can definitely think about Splunk Answers community again 🙂

[weidertc]

Thanks, i'll take a look at SplunkJS. If it has to be installed, and if we don't have it, we probably won't get it.

For 2), i'm not sure what SPL is. Can you clarify? Also, where would I use the independent search?

[vnravikumar]

Hi @weidertc

Please check whether it helps you

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>First Dropdown</label>
      <choice value="red">Red</choice>
      <choice value="blue">Blue</choice>
      <choice value="black">Black</choice>
      <change>
        <condition label="Red">
          <set token="form.field2">green</set>
          <set token="showPanel"> true</set>
        </condition>
        <condition label="Blue">
          <set token="form.field2">white</set>
          <unset token="showPanel"> </unset>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="field2">
      <label>Second Dropdown</label>
      <choice value="green">Green</choice>
      <choice value="white">White</choice>
    </input>
  </fieldset>
</form>

[weidertc]

thanks for the reply. unfortunately, since the conditions are unrelated, i cannot set the input2 value at the time i decide whether to show the panel. I should have clarified this earlier, sorry.

[vnravikumar]

Can you please explain your requirement.

[weidertc]

I'll have to get specific.

The 2 conditions do unrelated things. it's a dropdown that's populated based on the values of yet another dropdown. there's 4 dropowns in linear hierarchy if it helps. this is the 3rd one down.

If "None" is chosen, then i want the 4th dropdown to show "None". If anything else is chosen, then I want the 4th dropdown to show "All" until the user selects a different one. this is independent of the panel i want to show.

If 2 values are specifically chosen, then i want a particular panel to show. it's specific to a value chosen in the 1st, 2nd, and 3rd dropdowns, but there's enough info in the 3rd dropdown only at the moment to know. this will stay off most of the time since that panel's values can change a lot and those 2 values may not even be in the resultset based on what the user chose in the 1st and 2nd dropdown.

There are going to be a lot of specific panels based on dropdown values, so a solution should scale nicely.

hope this clears it up.

[vnravikumar]

Hi @weidertc

Please check now,

  <form>
      <init>
            <unset token="showpanel"></unset>
      </init>
      <label>dropdown</label>
      <fieldset submitButton="false">
        <input type="dropdown" token="field1">
          <label>Third Dropdown</label>
          <choice value="none">None</choice>
          <choice value="red">Red</choice>
          <choice value="blue">Blue</choice>
          <choice value="black">Black</choice>
          <change>
            <condition match="$field1$ == &quot;none&quot;">
              <set token="form.field2">none</set>
              <unset token="showpanel"></unset>
            </condition>
            <condition match="$field1$ != &quot;none&quot;">
              <set token="form.field2">*</set>
            </condition>
          </change>
        </input>
        <input type="dropdown" token="field2">
          <label>Fourth Dropdown</label>
          <choice value="*">All</choice>
          <choice value="none">None</choice>
          <choice value="green">Green</choice>
          <choice value="white">White</choice>
          <change>
            <condition match="$field1$ == &quot;none&quot; or $field2$ == &quot;none&quot; or $field2$ == &quot;*&quot;">
              <unset token="showpanel"></unset>
            </condition>
            <condition>
              <set token="showpanel">true</set>
            </condition>
          </change>
        </input>
      </fieldset>
      <row>
        <panel depends="$showpanel$">
          <table>
            <search>
              <query>index="_internal"</query>
              <earliest>-24h@h</earliest>
              <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
      </row>
    </form>

[weidertc]

It looks like you removed the part where only 1 of 2 values are supposed to show the panel, that being 4.1.1 and 4.1.2 in field1. all other values should hide the panel. would this be as simple as adding a match to the last condition of field2?

[vnravikumar]

yes you are correct,

[weidertc]

this solution won't scale then, since it will match and break out of the change tag. I need a solution that will allow for multiple panels each with their own condition that may overlap.

sorry to be difficult, but am I otherwise correct in asserting that Splunk does not allow multiple condition sets on an input panel?

[vnravikumar]

Here panel will be shown one and only if a specific value is chosen in both dropdown. Otherwise, it will hide.

[vnravikumar]

I hope the above sample helps you.

[vnravikumar]

@weidertc Please let me know if you need any help further.