Splunk Search

How to hide input based on another input?

splunkrocks2014
Communicator

I have two different inputs, "by usage" and "by process", and I want to use a radio button to control the those inputs to be visible to end -user. How can I do that? Thanks.

<form>
  <label>Process Tracking</label>
  <fieldset submitButton="false">
    <input type="radio" token="p_cat">
      <label>Category</label>
      <choice value="u">by Usage</choice>
      <choice value="p">by Process</choice>
      <default>u</default>
      <initialValue>u</initialValue>
    </input>
    <input type="text" token="p_process">
      <label>by Process</label>
    </input>
    <input type="dropdown" token="p_usage" searchWhenChanged="false">
      <label>by Usage</label>
      <search>
        <query>| inputlookup usage_ranges.csv</query>
        <earliest>0</earliest>
      </search>
      <fieldForLabel>range</fieldForLabel>
      <fieldForValue>range</fieldForValue>
      <initialValue>usage<1%</initialValue>
      <default>usage<1%</default>
    </input>
  </fieldset>
...
</form>
Tags (1)

somesoni2
Revered Legend

Try like this

<form>
   <label>Process Tracking</label>
   <fieldset submitButton="false">
     <input type="radio" token="p_cat">
       <label>Category</label>
       <choice value="u">by Usage</choice>
       <choice value="p">by Process</choice>
       <default>u</default>
       <initialValue>u</initialValue>
       <change>
         <condition label="by Usage">
           <set token="showProcess">Y</set>
           <unset token="showUsage"></unset>
         </condition>
         <condition label="by Process">
           <set token="showUsage">Y</set>
           <unset token="showProcess"></unset>
         </condition>
       </change>
     </input>
     <input type="text" token="p_process" depends="$showProcess$">
       <label>by Process</label>
     </input>
     <input type="dropdown" token="p_usage" depends="$showUsage$" searchWhenChanged="false">
       <label>by Usage</label>
       <search>
         <query>| inputlookup usage_ranges.csv</query>
         <earliest>0</earliest>
       </search>
       <fieldForLabel>range</fieldForLabel>
       <fieldForValue>range</fieldForValue>
       <initialValue>usage<1%</initialValue>
       <default>usage<1%</default>
     </input>
   </fieldset>
 ...
 </form>

splunkrocks2014
Communicator

Hi somesoni2, thank you for your solution. It works as expected. I have another question if you don't mind. When the "p_process" is set, I just want to pass "process="$p_process$" to the search query, but for the range, I want to remove "process="$p_process$" and adding a lookup for range. Basically, there will be different search queries corresponding to the condition. From the search panel, I tried to set up condition like below, but it doesn't work at all. What did I miss?
...



XYZ



index=abc sourcetype=efg | lookup my_lookup process AS process | where range="$p_usage$" | stats dc(host) AS count by process


index=abc sourcetype=efg process="$p_process$" | stats dc(host) AS count by process

$tk_query$
...

...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...