Splunk Search

How to use radio button choices in case statements?

dhruv101
Path Finder

Hi,

I have a simple checkbox as shown below -

<input type="checkbox" token="eventtype" searchWhenChanged="true">
      <label>Event Type</label>
      <choice value="*">All</choice>
      <choice value="Event1">Event1</choice>
      <choice value="Event2">Event2</choice>
      <choice value="Event3">Event3</choice>
      <choice value="Event4">Event4</choice>
      <valuePrefix>$$payload.type$$ == "</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <default>*</default>
    </input>

I have a query which basically checks if Type is "A" or "B" and based on that selects x and y axis of a column chart. When Type is "B" I want to further filter using radio button as shown in query(AND $eventtype$) which would evaluate to $$payload.type$$ == "Event?". But as this is a case statement "*"(for All case) regex matching does not work. What can I use such that for the case "All" anything can match? Also, if I am over-complicating this, is there an easier way to do this?

    index="app_event"  
    | eval myFan=mvrange(0,3) 
    | mvexpand myFan 
    | eval _time = case(myFan=0 AND Type == "A", $$payload.beginVal$$, 
       myFan=1 AND Type == "A", $$payload.endVal$$, 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.beginVal$$) 
    | eval phase = case(myFan=0 AND Type == "A", "BeginVal", 
       myFan=1 AND Type == "A", "EndVal", 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$) 
    | eval Time = strftime (_time/pow(10,9), "%F %T.%9Q") 
    | chart count by Time phase
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @dhruv101 ,

Either you could you case(match(field,"regex")) or you could push the * as a default statement in the case

     | eval phase = case(myFan=0 AND Type == "A", "BeginVal",  myFan=1 AND Type == "A", "EndVal", 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$,1==1,"All my selections end up here") 
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @dhruv101 ,

Either you could you case(match(field,"regex")) or you could push the * as a default statement in the case

     | eval phase = case(myFan=0 AND Type == "A", "BeginVal",  myFan=1 AND Type == "A", "EndVal", 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$,1==1,"All my selections end up here") 
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...