Splunk Search

How to create a conditional search where certain search strings are run based on the radio button input chosen by a user?

purva13
Explorer

I am new to Splunk and trying to know more about it. I have a dashboard where I am taking inputs from user in the form of 'radio' buttons.
Now, I want my information to be filtered according to the user input. My radio buttons are Summary and details.

xxxx | eval e1 = if("$INFO or DEBUG$"=="INFO", search string 1, search string 2) | sort _time

If the user's input is INFO, it should append search string 1 into my original 'xxxx' query and if not, then search string 2 should be appended in original query. But this code is just creating a field e1 which has correct search string according to my if statement. How can I do this?

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi purva13,

You cannot do it this way, but you can do it in a different way. You can assign prefix and suffix to the radio buttons and use different values this way. Copy the below pasted XML into a new dashboard and it will show you how it can be done.

<form>
  <label>run search based on button</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="radio" token="field1" searchWhenChanged="true">
      <label>what to search?</label>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
      <choice value="*">all</choice>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunkd_access">splunkd_access</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Search being run: index=_internal $$field1$$</title>
      <event>
        <search>
          <query>index=_internal $field1$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>

Hope this helps and gets you started ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi purva13,

You cannot do it this way, but you can do it in a different way. You can assign prefix and suffix to the radio buttons and use different values this way. Copy the below pasted XML into a new dashboard and it will show you how it can be done.

<form>
  <label>run search based on button</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="radio" token="field1" searchWhenChanged="true">
      <label>what to search?</label>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
      <choice value="*">all</choice>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunkd_access">splunkd_access</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Search being run: index=_internal $$field1$$</title>
      <event>
        <search>
          <query>index=_internal $field1$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>

Hope this helps and gets you started ...

cheers, MuS

View solution in original post

purva13
Explorer

Hey, that sounds interesting. But while trying that I am getting an error

XML Syntax Error: Cannot find object mapper for panel type: title
0 Karma

MuS
SplunkTrust
SplunkTrust

Just to add, you can place search strings as well into the choice option like this:

<choice value="_audit">search index=_internal</choice>
<choice value="_internal">search index=_audit</choice>

and using a query option like this:

<query>$field1$</query>
0 Karma

purva13
Explorer

But I don't want the query to be displayed to users. And I want it to be appended to original query.
Also, in the answer with suffix and prefix, are you talking about populating search?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!