All Apps and Add-ons

How to conditionally break out of a search

kragel
Path Finder

I have a view with multiple searches. When I execute search #2, if the value of action = discard I want to display the results with a table and stop everything. But if action != discard I want to move on to search #3, then continue on to search #4, etc.

I can't figure out how to accomplish this or do it another way. I don't know if I need to use if(X,Y,Z) or close my modules differently or something else. Does anyone have any suggestions and/or an example? Thanks.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>  
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
 </module>
 <module name="TextField" layoutPanel="panel_row1_col1">
   <param name="name">address</param>
   <param name="float">left</param>
   <module name="Button">
     <param name="allowSoftSubmit">True</param>
     <module name="TimeRangePicker">
       <param name="default">Last 4 hours</param>
       <module name="Search">
         <param name="search">search #1| table somefields</param>
         <module name="Search">
           <param name="search">search #2| table somefields</param>
           <module name="Search">  
             <param name="search">search #3| table somefields</param>
             <module name="Search">
               <param name="search">search #4| table somefields</param>
             </module>
           </module>
         </module>
       </module>
...
</view>
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can build some (mildly crude) branching with a combination of ResultsValueSetter and Gate:

<module name="Search">
  <param name="search">
    <![CDATA[| stats count | eval address="$address$" | eval nope=case(address=="discard","something") | eval yep = case(isnull(nope),"something")
    ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">yep,nope</param>
    <module name="Gate">
      <param name="requiredKeys">yep</param>
      <module name="Table" />
    </module>
    <module name="Gate">
      <param name="requiredKeys">nope</param>
      <module name="Search">
        <param name="search">| stats count | eval address="nope"</param>
        <module name="Table" />
      </module>
    </module>
  </module>
</module>

There's an $address$ token passed from your upstream text field. The first search has formed a decision, denoted by the presence of either field yep or field nope. These are made available as tokens $yep$ and $nope$, allowing exactly one Gate to open. One subbranch displays the most recent search result (add field hiding to get rid of yep later), the other subbranch runs another search before displaying the result.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can build some (mildly crude) branching with a combination of ResultsValueSetter and Gate:

<module name="Search">
  <param name="search">
    <![CDATA[| stats count | eval address="$address$" | eval nope=case(address=="discard","something") | eval yep = case(isnull(nope),"something")
    ]]></param>
  <module name="ResultsValueSetter">
    <param name="fields">yep,nope</param>
    <module name="Gate">
      <param name="requiredKeys">yep</param>
      <module name="Table" />
    </module>
    <module name="Gate">
      <param name="requiredKeys">nope</param>
      <module name="Search">
        <param name="search">| stats count | eval address="nope"</param>
        <module name="Table" />
      </module>
    </module>
  </module>
</module>

There's an $address$ token passed from your upstream text field. The first search has formed a decision, denoted by the presence of either field yep or field nope. These are made available as tokens $yep$ and $nope$, allowing exactly one Gate to open. One subbranch displays the most recent search result (add field hiding to get rid of yep later), the other subbranch runs another search before displaying the result.

kragel
Path Finder

ResultsValueSetter and Gate accomplished what I needed. Thanks.

0 Karma

kragel
Path Finder

Search #2 returns at most 10 results. But they all have the same value for the field I'm looking at so I only really need one result.

Thanks for the suggestion on ResultsValueSetter and Gate. I'm currently trying to get that to work.

0 Karma

somesoni2
Revered Legend

How many rows does your search #2 returns??

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...