topic Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0? in Dashboards & Visualizations

Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

robertlynch2020 — Sun, 13 Nov 2016 16:02:53 GMT

The below used to work in previous version of SPLUNK before 6.5.
It is a drop-down that gets populated from a lookup.
I want to check if the user picks "Add new project" , however, now it is automatically picking it without the user interacting.

Has something changed in SPLUNK 6.5, as this has been working for multiple versions us to now?

    <label>Select which project this applies to</label>
    <search>
      <!-- Get a list of existing projects, plus two static values at the end: "Add new project", and "Remove from project" -->
      <query>| makeresults annotate=false count=1 | eval log_drop_name="$host_token$" | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | eval project = if(isnull(project),"",project) | inputlookup append=true PROJECT_GROUPINGS.csv | append [ | makeresults annotate=false count=1 | eval project="Remove from project" ] | append [ | makeresults annotate=false count=1 | eval project="Add new project" ] | table project | dedup project | head $projects_refresher$</query>
    </search>
    <fieldForLabel>project</fieldForLabel>
    <fieldForValue>project</fieldForValue>
    <selectFirstChoice>true</selectFirstChoice>
    <change>
      <condition value="Add new project">
        <set token="new_project_input">true</set>

        <unset token="form.new_project_input_text"></unset>

        <unset token="known_issues_project"></unset>
        <unset token="execute_add_known_issue"></unset>

        <unset token="execute_add_all_issues"></unset>
      </condition>
      <condition match="NOT value = 'Add new project'">
        <unset token="new_project_input"></unset>

        <eval token="known_issues_project">if('value'="",null,'value')</eval>

        <unset token="execute_add_known_issue"></unset>
        <unset token="execute_add_all_issues"></unset>
      </condition>
    </change>
  </input>

The query results are the following

| makeresults annotate=false count=1 | eval log_drop_name="$host_token$" | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | eval project = if(isnull(project),"",project) | inputlookup append=true PROJECT_GROUPINGS.csv | append [ | makeresults annotate=false count=1 | eval project="Remove from project" ] | append [ | makeresults annotate=false count=1 | eval project="Add new project" ] | table project | dedup project | head $projects_refresher$

NPC
Scotia-Errors
Add new project
Remove from project

SO "Add new project" is in the query, however, I need the end user to pick it before it drives other tokens.

All help is great as i have tried a few things...

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

niketn — Sun, 13 Nov 2016 20:36:32 GMT

Take out

<selectFirstChoice>true</selectFirstChoice>

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

rjthibod — Sun, 13 Nov 2016 21:31:23 GMT

Or change it to "false" to make it explicit

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

robertlynch2020 — Tue, 29 Sep 2020 11:45:10 GMT

Sorry but this does not work.

"new_project_input" is been set to true!

For some reason in the new SPLUNK 6.5 the value is set as "Add new Project", even do nothing has been picked? This worked in other version, so i am thinking of reporting it as a bug.

    <change>
      <condition value="Add new project">
        <set token="new_project_input">true</set>

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

woodcock — Thu, 30 Mar 2017 22:11:14 GMT

If you create a run-anywhere example (using index=_*, getting rid of lookup and inputlookup, etc.), and post a complete XML, then I (and probably others) will try to help.

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

nfilippi_splunk — Thu, 30 Mar 2017 22:55:48 GMT

Have you tried something like this:

<condition match="value != &quot;Add new project&quot;">

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

robertlynch2020 — Fri, 21 Apr 2017 15:05:22 GMT

Hi - Just getting to this NOW. Looks like this is it. Thanks very much

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

robertlynch2020 — Fri, 21 Apr 2017 15:05:50 GMT

This worked in the end - Thanks 🙂

 <condition match="value != &quot;Add new project&quot;">

I have no idea why my Orginal code stopped working, but this is doing the trick. Cheers 🙂

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

niketn — Fri, 21 Apr 2017 15:16:16 GMT

@robertlynch2020... Please upvote @nfilippi comment since his suggested code is what worked for you. Ideally you should have accepted his comment as answer!

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

robertlynch2020 — Fri, 21 Apr 2017 15:19:14 GMT

I was trying to accept his comment, but i cant as its a commend on an answer.
SO i will upvote no worries, but how do i accept his answer ?

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

robertlynch2020 — Fri, 21 Apr 2017 15:20:40 GMT

Unless he re-posts as an answer then i will accept perhaps ?
Im easy, he saved me a lot of work so i defo want to say thanks 🙂

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

robertlynch2020 — Fri, 21 Apr 2017 15:23:55 GMT

for some reason i cant do more - > convert to answer!

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

niketn — Fri, 21 Apr 2017 16:48:06 GMT

Sorry @robertlynch2020 , you have accepted wrong answer. Please unaccept this and accept nfilippi's Answer.

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

robertlynch2020 — Fri, 21 Apr 2017 16:55:23 GMT

Hi - I have done this now: FYI this option was not available to be 30 minutes ago. His answer has been moved into an answer and not a comment off an answer.

But its all fixed now, so cheers for your help 🙂

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

harishalipaka — Thu, 30 Nov 2017 08:00:18 GMT

hi am also searching for this type of problem please help for this .my question links are::

https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html

https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

harishalipaka — Thu, 30 Nov 2017 08:02:15 GMT

hi am also searching for this type of problem please help for this .my question links are::

https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html

https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

harishalipaka — Thu, 30 Nov 2017 08:02:29 GMT

hi am also searching for this type of problem please help for this .my question links are::

https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html

https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html