CODEWITHSUNDEEP
splunk
Developer
Developer

Reputation: 307

Splunk - Add Conditional On Input

I have a Splunk Dashboard. This dashboard has a Text input where the user can enter a path. After entering the input, I would like to apply some conditional logic to the path input by the user before the search is executed. Is this possible in Splunk? Is there a way for me to take the Text input (i.e. path) and do something like:

var parameter1 = "value-a";
if (path == "/endpoint-1")
  parameter1 = "value-b";
else if (path == "/endpoint-2")
  parameter1 = "/endpoint-3";

// Execute search with parameter1

Thank you.

Upvotes: 0

Views: 772

Answers (1)

Daniel Price
Daniel Price

Reputation: 483

Subsearches! Eg:

index=data [
| makeresults 1
| eval path="$inputToken$"
| eval parameter1=case(
path="/endpoint-1","value-b,
path="/endpoint-2","/endpoint-3")
| fields parameter1
| format]

the subsearches are run before the main search, and alter that main search. the main search here after the subsearch would be something like.

index=data parameter1="value-b"

Related reading to help on your sub search journey

https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Useasubsearch

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Format

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return

Upvotes: 1

Related Questions