Splunk Search

How to use radio button choices in case statements?

dhruv101
Path Finder

Hi,

I have a simple checkbox as shown below -

<input type="checkbox" token="eventtype" searchWhenChanged="true">
      <label>Event Type</label>
      <choice value="*">All</choice>
      <choice value="Event1">Event1</choice>
      <choice value="Event2">Event2</choice>
      <choice value="Event3">Event3</choice>
      <choice value="Event4">Event4</choice>
      <valuePrefix>$$payload.type$$ == "</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <default>*</default>
    </input>

I have a query which basically checks if Type is "A" or "B" and based on that selects x and y axis of a column chart. When Type is "B" I want to further filter using radio button as shown in query(AND $eventtype$) which would evaluate to $$payload.type$$ == "Event?". But as this is a case statement "*"(for All case) regex matching does not work. What can I use such that for the case "All" anything can match? Also, if I am over-complicating this, is there an easier way to do this?

    index="app_event"  
    | eval myFan=mvrange(0,3) 
    | mvexpand myFan 
    | eval _time = case(myFan=0 AND Type == "A", $$payload.beginVal$$, 
       myFan=1 AND Type == "A", $$payload.endVal$$, 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.beginVal$$) 
    | eval phase = case(myFan=0 AND Type == "A", "BeginVal", 
       myFan=1 AND Type == "A", "EndVal", 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$) 
    | eval Time = strftime (_time/pow(10,9), "%F %T.%9Q") 
    | chart count by Time phase
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @dhruv101 ,

Either you could you case(match(field,"regex")) or you could push the * as a default statement in the case

     | eval phase = case(myFan=0 AND Type == "A", "BeginVal",  myFan=1 AND Type == "A", "EndVal", 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$,1==1,"All my selections end up here") 
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @dhruv101 ,

Either you could you case(match(field,"regex")) or you could push the * as a default statement in the case

     | eval phase = case(myFan=0 AND Type == "A", "BeginVal",  myFan=1 AND Type == "A", "EndVal", 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$,1==1,"All my selections end up here") 
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...