Activity Feed
- Posted Re: Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-15-2019 12:37 AM
- Posted Re: Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-14-2019 10:17 AM
- Posted Re: Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-14-2019 06:58 AM
- Posted Re: Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-14-2019 06:40 AM
- Posted Re: Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-14-2019 06:29 AM
- Posted Re: Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-13-2019 01:57 PM
- Posted Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-13-2019 09:22 AM
- Tagged Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-13-2019 09:22 AM
- Tagged Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-13-2019 09:22 AM
- Tagged Evaluating User dropdown options for Splunk Dashboard and dynamically changing title field on Splunk Search. 05-13-2019 09:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
05-15-2019
12:37 AM
Okay, the two queries are exactly the same behavior wise.
The intention of both queries is to get evaluate the dropdown options and change the title based on the options. For example, if a user picks "Apple" in one drop down and "Fruit" in the second drop down, the title will change to "Fruit: Apple".
Now the first query works completely fine and executes the action I need.
The second query does not work. Now the difference between query 1 and query 2 is small, the only difference is that there is a linebreak between the two conditionals (I have added a comment to where the line break is). With query 2, when a line break is inserted, the title field is not updated and the title is shown only as "$estToken$".
Now my ask is that does inserting a line break impact this? My thought is that it should not matter but in my case inserting a line breaks the functionality. I want a line break to just make the XML clearer to read.
... View more
05-14-2019
10:17 AM
Okay, I have found out what I want to achieve by using case statement. I have a further question, does having a line break cause difference in xml/splunk execution. For example,
<eval token="testToken">case($var1$="Apple" AND $var2$="(producttype=fruit)", "Fruit: Apple", (($var1$="Banana") AND ($var2$="(producttype=fruit)")), "Fruit: Banana")</eval>
The above works fine. I can access the testToken in the title field and it dynamically gets the value. However, when I want to make a line between conditions, for example:
<eval token="testToken">case($var1$="Apple" AND $var2$="(producttype=fruit)", "Fruit: Apple",
//LINE BREAK
(($var1$="Banana") AND ($var2$="(producttype=fruit)")), "Fruit: Banana")</eval>
I am unable to access testToken in title, it just shows in the title as $testToken$.
Do you know about this?
... View more
05-14-2019
06:58 AM
Also, how will this work? Seems the evaluation not happening for nested if statements. if($field1$="1 day ago" AND $field2$="1 day ago","Test1","Test2", if($field1$="1 day ago" AND $field2$="3 days ago","Test3","Test4"))
... View more
05-14-2019
06:40 AM
For example:
Condition 1: if($field1$="1 day ago" AND $field2$="2 days ago","Option 123","yyyy")
Condition 2: if($field1$="2 day ago" AND $field2$="2 days ago","Option 124","yyyy")
Condition 3: if($field1$="3 day ago" AND $field2$="2 days ago","Option 125","yyyy")
Condition 4: if($field1$="4 day ago" AND $field2$="2 days ago","Option 126","yyyy")
Condition 5: if($field1$="5 day ago" AND $field2$="2 days ago","Option 127","yyyy")
I have many of these statements, what do you recommend as the cleanest way to construct this?
... View more
05-14-2019
06:29 AM
Got it. Thank you very much so for this situation, I have many different combinations that will modify the title (Over 30). What do you recommend will be the cleanest approach to do this?
... View more
05-13-2019
01:57 PM
Hi. Thanks for your answer! So what you provided is what partially what I am looking for. I still want a way to evaluate both the values provided from the drop downs and doing an action based on this.
For example:
1) If the user selected '1 day ago' in field1 and selected '2 days ago' in field 2, I want the title to change to 'Option 123'
2) If the user selected '2 days ago' in field1 and selected '1 day ago' in field 2, I want the title to change to 'Option 321'
There can be many combinations of this input, I just want a way of evaluating both values and changing the title based on this logic.
Is this possible? Thanks!
... View more
05-13-2019
09:22 AM
I have a Splunk dashboard which allows users to select two different fields.
My goal is I want a way for Splunk dashboard to evaluate the two different fields and take appropriate action based on the two fields.
Example dashboard:
<form>
<label>Test Graph</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="field1" searchWhenChanged="true">
<label>Select Time Range</label>
<choice value="1 day ago">1 day ago</choice>
<choice value="2 days ago">2 days ago</choice>
<default>1 day ago</default>
</input>
</fieldset>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="field1" searchWhenChanged="true">
<label>Select Time Range</label>
<choice value="1 day ago">1 day ago</choice>
<choice value="2 days ago">2 days ago</choice>
<default>1 day ago</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<title>Test Title - $field1$</title>
</chart>
</panel>
</row>
</form>
As you can see from above, there are two different drop down option boxes. Which both have values '1 day ago' and '2 days ago'.
Below this, I also have a title which dynamically gets value from 'field1'.
What I want to do is when a user selects a specific value from field1 and another value from field2, it changes the title field to a value.
For example:
if ($field1$ == '1 day ago' && $field2$ == '2 day ago') {
//execute action to change title field here.
}
... View more
