- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a union [] command that I want to execute only if a check box is checked, how can I manage this? SPL2 branch doesn't work on my dashboard for some reason and the eval if else only works for assigning a value to a var, what options do I have now?
| search | if value = 'so and so' execute union [sql]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You want to add a change handler to the checkbox so that if the box is not checked, it sets the token to "```" and if it is checked, it sets it to ""
| search | appendpipe [$checkboxtoken$ | spl for additional events $checkboxtoken$]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SPL is not a procedural language.
Depending on you actual usecase, you could set a token value based on whether the check box is checked which includes all the SPL you want included in your search, and then just use this token in the search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am doing that right now, and it's messy, very messy because my block of code is large and has many other tokens in it. It's just a big mess.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Another possibility is that you use appendpipe with a where clause to evaluate whether the token is set at the beginning and the rest of the SPL following the where clause
More than one way to skin a cat!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you give me an example in code, this seems interesting
this method of skinning a cat seems interesting
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| search | appendpipe [| where $token$="value meaning execute SPL" | spl to execute]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You want to add a change handler to the checkbox so that if the box is not checked, it sets the token to "```" and if it is checked, it sets it to ""
| search | appendpipe [$checkboxtoken$ | spl for additional events $checkboxtoken$]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I found another solution to my issue that doesn't require me to have the 2nd block of code in the first place. But if I did go ahead with that block I'd have chosen this method. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is ``` some sort of commenting?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, as of Splunk version 8.something I think
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm gonna try these and get back to you sir, May the Splunk God be with you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Another possibility (untested) is that you set the value of the checkbox token to 3 backticks (denoting start/end of comment) and place the token at the beginning and end of your union commands