Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Using radio button choices in case statements

$
0
0
Hi, I have a simple checkbox as shown below - AllEvent1Event2Event3Event4$$payload.type$$ == "" OR * I have a query which basically checks if Type is "A" or "B" and based on that selects x and y axis of a column chart. When Type is "B" I want to further filter using radio button as shown in query(AND $eventtype$) which would evaluate to $$payload.type$$ == "Event?". But as this is a case statement "*"(for All case) regex matching does not work. What can I use such that for the case "All" anything can match? Also, if I am over-complicating this, is there an easier way to do this? index="app_event" | eval myFan=mvrange(0,3) | mvexpand myFan | eval _time = case(myFan=0 AND Type == "A", $$payload.beginVal$$, myFan=1 AND Type == "A", $$payload.endVal$$, myFan=2 AND Type == "B" AND $eventtype$, $$payload.beginVal$$) | eval phase = case(myFan=0 AND Type == "A", "BeginVal", myFan=1 AND Type == "A", "EndVal", myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$) | eval Time = strftime (_time/pow(10,9), "%F %T.%9Q") | chart count by Time phase

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>