Hello,
I am trying to code a dashboard on Splunk.
I have a value of an input and would like to realize a specific code if the result of my input is A and another one if the input is B.
I was looking at the if
condition but I didn't find anything correct.
Could you help me?
Thanks a lot.
@telecomdesign,
If you are looking for executing searches with minor changes with respect to field values , you can use tokens from the input panel.
Reference : https://docs.splunk.com/Documentation/Splunk/7.3.0/Viz/tokens#Define_tokens_for_form_inputs
If your searches are entirely different, then probably create two panels with respective searches and show/hide one of them based on your inputs.
Please find a run anywhere example with dropdown input. You could also use radio buttons or other inputs
Just copy & paste the xml to a dashboard and it should work
<form>
<label>Conditional Inputs</label>
<fieldset submitButton="false">
<input type="dropdown" token="inputs">
<label>field1</label>
<choice value="search1">Input A</choice>
<choice value="search2">Input B</choice>
<initialValue>search1</initialValue>
<change>
<condition value="search1">
<set token="search_one"></set>
<unset token="search_two"></unset>
</condition>
<condition value="search2">
<unset token="search_one"></unset>
<set token="search_two"></set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel depends="$search_one$">
<table>
<search>
<query>| makeresults| eval param="SEARCH1"</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel depends="$search_two$">
<table>
<search>
<query>| makeresults| eval param="SEARCH2"</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>