Splunk Search

How to hide input based on another input?

splunkrocks2014
Communicator

I have two different inputs, "by usage" and "by process", and I want to use a radio button to control the those inputs to be visible to end -user. How can I do that? Thanks.

<form>
  <label>Process Tracking</label>
  <fieldset submitButton="false">
    <input type="radio" token="p_cat">
      <label>Category</label>
      <choice value="u">by Usage</choice>
      <choice value="p">by Process</choice>
      <default>u</default>
      <initialValue>u</initialValue>
    </input>
    <input type="text" token="p_process">
      <label>by Process</label>
    </input>
    <input type="dropdown" token="p_usage" searchWhenChanged="false">
      <label>by Usage</label>
      <search>
        <query>| inputlookup usage_ranges.csv</query>
        <earliest>0</earliest>
      </search>
      <fieldForLabel>range</fieldForLabel>
      <fieldForValue>range</fieldForValue>
      <initialValue>usage<1%</initialValue>
      <default>usage<1%</default>
    </input>
  </fieldset>
...
</form>
Tags (1)

somesoni2
Revered Legend

Try like this

<form>
   <label>Process Tracking</label>
   <fieldset submitButton="false">
     <input type="radio" token="p_cat">
       <label>Category</label>
       <choice value="u">by Usage</choice>
       <choice value="p">by Process</choice>
       <default>u</default>
       <initialValue>u</initialValue>
       <change>
         <condition label="by Usage">
           <set token="showProcess">Y</set>
           <unset token="showUsage"></unset>
         </condition>
         <condition label="by Process">
           <set token="showUsage">Y</set>
           <unset token="showProcess"></unset>
         </condition>
       </change>
     </input>
     <input type="text" token="p_process" depends="$showProcess$">
       <label>by Process</label>
     </input>
     <input type="dropdown" token="p_usage" depends="$showUsage$" searchWhenChanged="false">
       <label>by Usage</label>
       <search>
         <query>| inputlookup usage_ranges.csv</query>
         <earliest>0</earliest>
       </search>
       <fieldForLabel>range</fieldForLabel>
       <fieldForValue>range</fieldForValue>
       <initialValue>usage<1%</initialValue>
       <default>usage<1%</default>
     </input>
   </fieldset>
 ...
 </form>

splunkrocks2014
Communicator

Hi somesoni2, thank you for your solution. It works as expected. I have another question if you don't mind. When the "p_process" is set, I just want to pass "process="$p_process$" to the search query, but for the range, I want to remove "process="$p_process$" and adding a lookup for range. Basically, there will be different search queries corresponding to the condition. From the search panel, I tried to set up condition like below, but it doesn't work at all. What did I miss?
...



XYZ



index=abc sourcetype=efg | lookup my_lookup process AS process | where range="$p_usage$" | stats dc(host) AS count by process


index=abc sourcetype=efg process="$p_process$" | stats dc(host) AS count by process

$tk_query$
...

...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap   From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...