Return fields based on boolean value

[hegga]

Hi,

I have a saved search used by a dashboard which should return different fields based on the boolean value of a string. For example:

if $show_raw_log$ == 1 do
   | fields _raw

if $show_raw_log$ == 0 do
   | fields _time,  sender, recipient, message_subject, attachment, vendor_action, message_id
   | fields - _raw

How can I achieve this in Splunk?

[niketn · Accepted solution]

@hegga, more details please. What sets the Boolean value $show_raw_log$, is it going to be a form input, a search or a drilldown event?

In any case you can use eval tag to set a query string token to be passed to your actual search.

<eval token="queryString">if($show_raw_log$==1, "| fields _raw", "| fields _time,  sender, recipient, message_subject, attachment, vendor_action, message_id | fields - _raw")</eval>

Then use token queryString in your actual search.
PS: Where ever in your current code you are setting $show_raw_log$ eval tag similar to the one above needs to be added, which implies $show_raw_log$ might not exist or may be represented by some other field/value or token.

[hegga]

Thanks @niketnilay! I'd wish you'd submitted this as an answer, so I could accept it. The boolean field is input from a checkbox in a dashboard which will be used in a search.

[niketn]

@hegga, I have converted to answer. Please accept 🙂