How to create a conditional search where certain search strings are run based on the radio button input chosen by a user?

[purva13]

I am new to Splunk and trying to know more about it. I have a dashboard where I am taking inputs from user in the form of 'radio' buttons.
Now, I want my information to be filtered according to the user input. My radio buttons are Summary and details.

xxxx | eval e1 = if("$INFO or DEBUG$"=="INFO", search string 1, search string 2) | sort _time

If the user's input is INFO, it should append search string 1 into my original 'xxxx' query and if not, then search string 2 should be appended in original query. But this code is just creating a field e1 which has correct search string according to my if statement. How can I do this?

[MuS · Accepted solution]

Hi purva13,

You cannot do it this way, but you can do it in a different way. You can assign prefix and suffix to the radio buttons and use different values this way. Copy the below pasted XML into a new dashboard and it will show you how it can be done.

<form>
  <label>run search based on button</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="radio" token="field1" searchWhenChanged="true">
      <label>what to search?</label>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
      <choice value="*">all</choice>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunkd_access">splunkd_access</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Search being run: index=_internal $$field1$$</title>
      <event>
        <search>
          <query>index=_internal $field1$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>

Hope this helps and gets you started ...

cheers, MuS

[purva13]

Hey, that sounds interesting. But while trying that I am getting an error

XML Syntax Error: Cannot find object mapper for panel type: title

[MuS]

Just to add, you can place search strings as well into the choice option like this:

<choice value="_audit">search index=_internal</choice>
<choice value="_internal">search index=_audit</choice>

and using a query option like this:

<query>$field1$</query>

[purva13]

But I don't want the query to be displayed to users. And I want it to be appended to original query.
Also, in the answer with suffix and prefix, are you talking about populating search?