How can we run searches based on token value?

[goyals05]

I have two different searches and i want to run those searches based on the token.

if any value is set for that token then Query 1 should run, else Query 2 should run.

[cmakepeace_splu]

An easy solution is to actually use the tokens that are created from a conditional statement on the dropdown menu within the actual search. These value and field is then immediately removed from the results. This works as the search will not run until the all tokens present within the search are set.

     <form>
       <fieldset submitButton="false">
         <input type="radio" token="sample_radio">
           <label>Select which search</label>
           <choice value="search1">search 1</choice>
           <choice value="search2">search 2</choice>
           <default></default>
           <change>
             <condition value="search1">
               <set token="search_one"></set>
               <unset token="search_two"></unset>
             </condition>
             <condition value="search2">
               <unset token="search_one"></unset>
               <set token="search_two"></set>
             </condition>
           </change>
         </input>
       </fieldset>
       <row>
         <panel>    
           <chart  depends="$search_one$">
             <title>Search One</title>
             <search>
               <query>Query 1 | eval temp=$search_one$ | fields - temp</query>
               <earliest>-15m@m</earliest>
               <latest>now</latest>
             </search>
           </chart>
           <chart depends="$search_two$">
             <title>Search Two</title>
             <search>
               <query>Query 2 | eval temp=$search_two$ | fields - temp</query>
               <earliest>-1d@d</earliest>
               <latest>now</latest>
             </search>
           </chart>
         </panel>
       </row>
     </form>

[lguinn2]

Perhaps something like this would work for you. This defines a dashboard with one input. There are two charts, but only one chart appears. The chart that appears is based on the user input.

<form>
  <fieldset submitButton="false">
    <input type="radio" token="period_tok">
      <label>Select a time range</label>
      <choice value="search1">Search One Description</choice>
      <choice value="search2">Search Two Description</choice>
      <default>Search One Description</default>
      <change>
        <condition value="search1">
          <set token="show_searchOne">any value</set>
          <unset token="show_searchTwo"></unset>
        </condition>
        <condition value="search2">
          <unset token="show_searchOne"></unset>
          <set token="show_searchTwo">any value</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>    
      <chart  depends="$show_searchOne$">
        <title>Search One</title>
        <search>
          <query>index = _internal | timechart count by sourcetype</query>
          <earliest>-15m@m</earliest>
          <latest>now</latest>
        </search>
      </chart>
      <chart depends="$show_searchTwo$">
        <title>Search Two</title>
        <search>
          <query>index = _internal | timechart count by source</query>
          <earliest>-1d@d</earliest>
          <latest>now</latest>
        </search>
      </chart>
    </panel>
  </row>
</form>

[goyals05]

Thanks but my requirement is slightly different. In below example if value of LIVE_or_DROP is set then Query 1 should be run otherwise Query 2 should be run.

      <set token="LIVE_or_DROP">LIVE</set>



<query>Query 1</query>
      <earliest>abc</earliest>
      <latest>xyz</latest>
<finalized>
        <set token="x">$result.total$</set>



<query>Query 2</query>
      <earliest>abc</earliest>
      <latest>xyz</latest>
<finalized>
        <set token="x">$result.total$</set>