topic Re: Why are Splunk multiple 'condition match' statements not working in my xml dashboard? in Dashboards & Visualizations

Why are Splunk multiple 'condition match' statements not working in my xml dashboard?

johnmvang — Thu, 01 Nov 2018 23:45:53 GMT

Hello,

I have the following dashboard code:

<progress>
<condition match="'job.resultCount' > 0">
              <set token="set_cp1_tok">$result.cp1$</set>
              <set token="set_cp2_tok">$result.cp2$</set>
              <set token="set_cp3_tok">$result.cp3$</set>
              <set token="set_pa1_tok">$result.pa1$</set>
              <set token="set_pa2_tok">$result.pa2$</set>
              <set token="set_pa3_tok">$result.pa3$</set>
              <set token="set_ws1_tok">$result.ws1$</set>
              <set token="set_ws2_tok">$result.ws2$</set>
              <set token="set_ws3_tok">$result.ws3$</set>
              <set token="set_dct1_tok">$result.dct1$</set>
              <set token="set_dct2_tok">$result.dct2$</set>
              <set token="set_dct3_tok">$result.dct3$</set>
              <set token="set_asm1_tok">$result.asm1$</set>
              <set token="set_asm2_tok">$result.asm2$</set>
              <set token="set_asm3_tok">$result.asm3$</set>
              <set token="set_asm11_tok">$result.asm11$</set>
              <set token="set_asm22_tok">$result.asm22$</set>
              <set token="set_desc_tok">$result.description$</set>
              <set token="edit_id_tok">$result.id$</set>
              <set token="show_loading">true</set>
              <set token="set_key_tok">$result.key$</set>
            </condition>
            <condition match="'result.custom_r1p1_vi'==&quot;line&quot;">
              <set token="show_row1p1_line">true</set>
            </condition>
            <condition match="'result.custom_r1p2_vi'==&quot;line&quot;">
              <set token="show_row1p2_line">true</set>
            </condition>
            <condition match="'result.custom_r1p3_vi'==&quot;line&quot;">
              <set token="show_row1p3_line">true</set>
            </condition>
</progress>

and only the first condition match statement is applying. The other 3 condition matches do not apply when the results are there, and the tokens should all be true.

I saw this answer, but every time i try to do it, i get XML errors stating i'm missing closing tags:

https://answers.splunk.com/answers/575552/set-multiple-tokens-using-condition-match.html

What am i doing wrong?

Re: Why are Splunk multiple 'condition match' statements not working in my xml dashboard?

kamlesh_vaghela — Fri, 02 Nov 2018 04:01:24 GMT

@johnmvang

If your search has data then the first condition will be executed; otherwise, it won't be. You have to write conditions in such a manner that will set your tokens for 'job.resultCount' > 0. Just remove the first condition and merge it with the remaining.

something like.

<condition match="''job.resultCount' > 0 AND result.custom_r1p1_vi'==&quot;line&quot;">
<set token="show_row1p1_line">true</set>
SET OTHER TOKENS
</condition>

Just let me know if you need further assistance.

Thanks

Re: Why are Splunk multiple 'condition match' statements not working in my xml dashboard?

johnmvang — Fri, 02 Nov 2018 16:11:21 GMT

thanks this works, i get it now. if you want to reply with an answer i can mark it as answered.

Re: Why are Splunk multiple 'condition match' statements not working in my xml dashboard?

kamlesh_vaghela — Fri, 02 Nov 2018 16:28:36 GMT

@johnmvang

Glad to help you. Please accept the answer and upvote.

Happy Splunking