Splunk Search

How to hide input based on another input?

splunkrocks2014
Communicator

I have two different inputs, "by usage" and "by process", and I want to use a radio button to control the those inputs to be visible to end -user. How can I do that? Thanks.

<form>
  <label>Process Tracking</label>
  <fieldset submitButton="false">
    <input type="radio" token="p_cat">
      <label>Category</label>
      <choice value="u">by Usage</choice>
      <choice value="p">by Process</choice>
      <default>u</default>
      <initialValue>u</initialValue>
    </input>
    <input type="text" token="p_process">
      <label>by Process</label>
    </input>
    <input type="dropdown" token="p_usage" searchWhenChanged="false">
      <label>by Usage</label>
      <search>
        <query>| inputlookup usage_ranges.csv</query>
        <earliest>0</earliest>
      </search>
      <fieldForLabel>range</fieldForLabel>
      <fieldForValue>range</fieldForValue>
      <initialValue>usage<1%</initialValue>
      <default>usage<1%</default>
    </input>
  </fieldset>
...
</form>
Tags (1)

somesoni2
Revered Legend

Try like this

<form>
   <label>Process Tracking</label>
   <fieldset submitButton="false">
     <input type="radio" token="p_cat">
       <label>Category</label>
       <choice value="u">by Usage</choice>
       <choice value="p">by Process</choice>
       <default>u</default>
       <initialValue>u</initialValue>
       <change>
         <condition label="by Usage">
           <set token="showProcess">Y</set>
           <unset token="showUsage"></unset>
         </condition>
         <condition label="by Process">
           <set token="showUsage">Y</set>
           <unset token="showProcess"></unset>
         </condition>
       </change>
     </input>
     <input type="text" token="p_process" depends="$showProcess$">
       <label>by Process</label>
     </input>
     <input type="dropdown" token="p_usage" depends="$showUsage$" searchWhenChanged="false">
       <label>by Usage</label>
       <search>
         <query>| inputlookup usage_ranges.csv</query>
         <earliest>0</earliest>
       </search>
       <fieldForLabel>range</fieldForLabel>
       <fieldForValue>range</fieldForValue>
       <initialValue>usage<1%</initialValue>
       <default>usage<1%</default>
     </input>
   </fieldset>
 ...
 </form>

splunkrocks2014
Communicator

Hi somesoni2, thank you for your solution. It works as expected. I have another question if you don't mind. When the "p_process" is set, I just want to pass "process="$p_process$" to the search query, but for the range, I want to remove "process="$p_process$" and adding a lookup for range. Basically, there will be different search queries corresponding to the condition. From the search panel, I tried to set up condition like below, but it doesn't work at all. What did I miss?
...



XYZ



index=abc sourcetype=efg | lookup my_lookup process AS process | where range="$p_usage$" | stats dc(host) AS count by process


index=abc sourcetype=efg process="$p_process$" | stats dc(host) AS count by process

$tk_query$
...

...

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...