Splunk Dev

Conditional Switcher not working

john
Communicator

Hi,
i want to switch the searches on the basis of token value from
dropdown. This is my conditional module its always showing only the value of second hidden search irrespective of condition.Please tell what iam missing here.


independent
(context.get("series")=="ERROR")


index="logs" ERROR


index="logs" Exception


Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

The problem is that the StaticRadio is sending down a context key called "series_setting". While that key is then being turned into a stringreplace intention by the name of "series", the context key itself is "series_setting", not "series".

So what you need to do is change context.get("series") to context.get("series_setting").
(or you could go the other way and change all the "series_setting" values to just "series".)

Intentions leave plenty of room for confusion. You might look at Sideview Utils because it does a lot of things to simplify view creation, not least of which is that you never have to use or think about intentions again...

john
Communicator

Thanks,Now its working

0 Karma

john
Communicator

hi melting,

I have done the changes you suggested.But there is no reflection on the dashboard.It is still executing the second search only

0 Karma

john
Communicator

This is my full view


myRadio
series_setting
field:


ERROR
ERROR


Ecxeption
Exception



series_setting

stringreplace


apache_error
$target$




independent
(context.get("series")=="ERROR")


index="logs" ERROR


index="logs" Exception


</module>


0 Karma

sideview
SplunkTrust
SplunkTrust

Can you include the modules upstream from the ConditionalSwitcher? The Switcher is getting the "series" value from the context, which presumably means some module upstream is putting in a "series" key. If you include the upstream modules then we can verify that the upstream part is as it should be.

melting
Splunk Employee
Splunk Employee

Without knowing your full view. The conditional switcher has some debug logging in it, so you could turn on logging and see the results in your browser's console.

If you want to turn on browser logging:
in $SPLUNK_HOME/etc/log.cfg python stanza
change all values to DEBUG
In web.conf settings stanza
js_logger_mode = Firebug

After turning logging on you will see messages like:
Splunk.Module.ConditionalSwitcher evaluating ...

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mile High Learning with Splunk University, Denver, Colorado

If Denver is known for its mile-high elevation, Splunk University is about to raise the bar on technical ...

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

We are excited to announce the June release of Splunk IT Service Intelligence (ITSI) 5.0. This update ...

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...