All Apps and Add-ons

How to conditionally break out of a search

kragel
Path Finder

I have a view with multiple searches. When I execute search #2, if the value of action = discard I want to display the results with a table and stop everything. But if action != discard I want to move on to search #3, then continue on to search #4, etc.

I can't figure out how to accomplish this or do it another way. I don't know if I need to use if(X,Y,Z) or close my modules differently or something else. Does anyone have any suggestions and/or an example? Thanks.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>  
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
 </module>
 <module name="TextField" layoutPanel="panel_row1_col1">
   <param name="name">address</param>
   <param name="float">left</param>
   <module name="Button">
     <param name="allowSoftSubmit">True</param>
     <module name="TimeRangePicker">
       <param name="default">Last 4 hours</param>
       <module name="Search">
         <param name="search">search #1| table somefields</param>
         <module name="Search">
           <param name="search">search #2| table somefields</param>
           <module name="Search">  
             <param name="search">search #3| table somefields</param>
             <module name="Search">
               <param name="search">search #4| table somefields</param>
             </module>
           </module>
         </module>
       </module>
...
</view>
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can build some (mildly crude) branching with a combination of ResultsValueSetter and Gate:

<module name="Search">
  <param name="search">
    <![CDATA[| stats count | eval address="$address$" | eval nope=case(address=="discard","something") | eval yep = case(isnull(nope),"something")
    ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">yep,nope</param>
    <module name="Gate">
      <param name="requiredKeys">yep</param>
      <module name="Table" />
    </module>
    <module name="Gate">
      <param name="requiredKeys">nope</param>
      <module name="Search">
        <param name="search">| stats count | eval address="nope"</param>
        <module name="Table" />
      </module>
    </module>
  </module>
</module>

There's an $address$ token passed from your upstream text field. The first search has formed a decision, denoted by the presence of either field yep or field nope. These are made available as tokens $yep$ and $nope$, allowing exactly one Gate to open. One subbranch displays the most recent search result (add field hiding to get rid of yep later), the other subbranch runs another search before displaying the result.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can build some (mildly crude) branching with a combination of ResultsValueSetter and Gate:

<module name="Search">
  <param name="search">
    <![CDATA[| stats count | eval address="$address$" | eval nope=case(address=="discard","something") | eval yep = case(isnull(nope),"something")
    ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">yep,nope</param>
    <module name="Gate">
      <param name="requiredKeys">yep</param>
      <module name="Table" />
    </module>
    <module name="Gate">
      <param name="requiredKeys">nope</param>
      <module name="Search">
        <param name="search">| stats count | eval address="nope"</param>
        <module name="Table" />
      </module>
    </module>
  </module>
</module>

There's an $address$ token passed from your upstream text field. The first search has formed a decision, denoted by the presence of either field yep or field nope. These are made available as tokens $yep$ and $nope$, allowing exactly one Gate to open. One subbranch displays the most recent search result (add field hiding to get rid of yep later), the other subbranch runs another search before displaying the result.

kragel
Path Finder

ResultsValueSetter and Gate accomplished what I needed. Thanks.

0 Karma

kragel
Path Finder

Search #2 returns at most 10 results. But they all have the same value for the field I'm looking at so I only really need one result.

Thanks for the suggestion on ResultsValueSetter and Gate. I'm currently trying to get that to work.

0 Karma

somesoni2
Revered Legend

How many rows does your search #2 returns??

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...