Splunk SOAR (f.k.a. Phantom)

change index value based on the dropdown selection

kavyakanne
Engager

So as per the Daily and Monthly selection index has to vary

Daily = index1
Monthly=index2

Thanks in Advance!

<fieldset>
      <label>Report Type</label>
       <choice value="Daily">Daily</choice>
        <choice value="Monthly">Monthly</choice>
</fieldset>
Labels (1)
Tags (1)
0 Karma
1 Solution

sanjeev543
Communicator

@kavyakanne perhaps you could try below option if you are looking to change the index name based on the Report Type option that you select

<fieldset submitButton="false">
     <input type="dropdown" token="idx">
       <label>Reporting Type</label>
       <choice value="daily_report_index_name">Daily</choice>
       <choice value="monthly_report_index_name">Monthly</choice>
       <default>daily_report_index_name</default>
     </input>
   </fieldset>
<!-- modify the search query with token name -->
<row>
     <panel>
      <title>Selected index option $idx$<title>
       <table>
         <search>
           <query>index=$idx$</query>
           <earliest>-60m@m</earliest>
           <latest>now</latest>
           </search>
</table>
</panel>
</row>

View solution in original post

0 Karma

sanjeev543
Communicator

@kavyakanne perhaps you could try below option if you are looking to change the index name based on the Report Type option that you select

<fieldset submitButton="false">
     <input type="dropdown" token="idx">
       <label>Reporting Type</label>
       <choice value="daily_report_index_name">Daily</choice>
       <choice value="monthly_report_index_name">Monthly</choice>
       <default>daily_report_index_name</default>
     </input>
   </fieldset>
<!-- modify the search query with token name -->
<row>
     <panel>
      <title>Selected index option $idx$<title>
       <table>
         <search>
           <query>index=$idx$</query>
           <earliest>-60m@m</earliest>
           <latest>now</latest>
           </search>
</table>
</panel>
</row>
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kavyakanne,
try something like this:

<form>
  <label>Test dropdown 2</label>
  <fieldset submitButton="false">
    <input type="radio" token="index">
      <label>Index</label>
      <choice value="wineventlog">wineventlog</choice>
      <choice value="_internal">_internal</choice>
      <default>wineventlog</default>
      <prefix>index="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>$index$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Obviously, you can use a different search.

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kavyakanne,
instead the index=weekly/monthly, you could insert in the choice the full search for each report,
try something like this:

<form>
  <label>Test dropdown 2</label>
  <fieldset submitButton="false">
    <input type="radio" token="index">
      <label>Index</label>
      <choice value="index=wineventlog | stats count BY EventCode">wineventlog</choice>
      <choice value="index=_internal | table _time source index sourcetype">_internal</choice>
      <default>index=wineventlog | stats count BY EventCode</default>
      <prefix/>
      <suffix/>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$index$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Ciao.
Giuseppe

0 Karma

kavyakanne
Engager

@gcusello

Could you assist me here!

Thanks in Advance!

0 Karma
Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...