Splunk Search

How to hide input based on another input?

splunkrocks2014
Communicator

I have two different inputs, "by usage" and "by process", and I want to use a radio button to control the those inputs to be visible to end -user. How can I do that? Thanks.

<form>
  <label>Process Tracking</label>
  <fieldset submitButton="false">
    <input type="radio" token="p_cat">
      <label>Category</label>
      <choice value="u">by Usage</choice>
      <choice value="p">by Process</choice>
      <default>u</default>
      <initialValue>u</initialValue>
    </input>
    <input type="text" token="p_process">
      <label>by Process</label>
    </input>
    <input type="dropdown" token="p_usage" searchWhenChanged="false">
      <label>by Usage</label>
      <search>
        <query>| inputlookup usage_ranges.csv</query>
        <earliest>0</earliest>
      </search>
      <fieldForLabel>range</fieldForLabel>
      <fieldForValue>range</fieldForValue>
      <initialValue>usage<1%</initialValue>
      <default>usage<1%</default>
    </input>
  </fieldset>
...
</form>
Tags (1)

somesoni2
Revered Legend

Try like this

<form>
   <label>Process Tracking</label>
   <fieldset submitButton="false">
     <input type="radio" token="p_cat">
       <label>Category</label>
       <choice value="u">by Usage</choice>
       <choice value="p">by Process</choice>
       <default>u</default>
       <initialValue>u</initialValue>
       <change>
         <condition label="by Usage">
           <set token="showProcess">Y</set>
           <unset token="showUsage"></unset>
         </condition>
         <condition label="by Process">
           <set token="showUsage">Y</set>
           <unset token="showProcess"></unset>
         </condition>
       </change>
     </input>
     <input type="text" token="p_process" depends="$showProcess$">
       <label>by Process</label>
     </input>
     <input type="dropdown" token="p_usage" depends="$showUsage$" searchWhenChanged="false">
       <label>by Usage</label>
       <search>
         <query>| inputlookup usage_ranges.csv</query>
         <earliest>0</earliest>
       </search>
       <fieldForLabel>range</fieldForLabel>
       <fieldForValue>range</fieldForValue>
       <initialValue>usage<1%</initialValue>
       <default>usage<1%</default>
     </input>
   </fieldset>
 ...
 </form>

splunkrocks2014
Communicator

Hi somesoni2, thank you for your solution. It works as expected. I have another question if you don't mind. When the "p_process" is set, I just want to pass "process="$p_process$" to the search query, but for the range, I want to remove "process="$p_process$" and adding a lookup for range. Basically, there will be different search queries corresponding to the condition. From the search panel, I tried to set up condition like below, but it doesn't work at all. What did I miss?
...



XYZ



index=abc sourcetype=efg | lookup my_lookup process AS process | where range="$p_usage$" | stats dc(host) AS count by process


index=abc sourcetype=efg process="$p_process$" | stats dc(host) AS count by process

$tk_query$
...

...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...