How to execute/ignore block of code based on token values?

[jonvijay1993]

I have a union [] command that I want to execute only if a check box is checked, how can I manage this? SPL2 branch doesn't work on my dashboard for some reason and the eval if else only works for assigning a value to a var, what options do I have now?

| search | if value = 'so and so' execute union [sql]

[ITWhisperer]

SPL is not a procedural language.

Depending on you actual usecase, you could set a token value based on whether the check box is checked which includes all the SPL you want included in your search, and then just use this token in the search.

[jonvijay1993]

I am doing that right now, and it's messy, very messy because my block of code is large and has many other tokens in it. It's just a big mess.

[ITWhisperer]

Another possibility is that you use appendpipe with a where clause to evaluate whether the token is set at the beginning and the rest of the SPL following the where clause

More than one way to skin a cat!

[jonvijay1993]

can you give me an example in code, this seems interesting
this method of skinning a cat seems interesting 

[ITWhisperer]

| search | appendpipe [| where $token$="value meaning execute SPL" | spl to execute]

[ITWhisperer · Accepted solution]

You want to add a change handler to the checkbox so that if the box is not checked, it sets the token to "```" and if it is checked, it sets it to ""

| search | appendpipe [$checkboxtoken$ | spl for additional events $checkboxtoken$]

[jonvijay1993]

Hi, I found another solution to my issue that doesn't require me to have the 2nd block of code in the first place. But if I did go ahead with that block I'd have chosen this method. Thanks!

[jonvijay1993]

Is ``` some sort of commenting?

[ITWhisperer]

Yes, as of Splunk version 8.something I think

[jonvijay1993]

I'm gonna try these and get back to you sir, May the Splunk God be with you!

[ITWhisperer]

Another possibility (untested) is that you set the value of the checkbox token to 3 backticks (denoting start/end of comment) and place the token at the beginning and end of your union commands