Why is my very simple dashboard token condition not working?

gabriel_vasseur — Mon, 24 Feb 2020 11:57:40 GMT

I can't seem to set/unset a token based on whether some search result is equal or not to 1.

Can anybody point out why this doesn't work:

<form>
  <label>TEMP Endpoint Processes Clone</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="number" searchWhenChanged="false">
      <label>Host count</label>
      <default>100</default>
      <initialValue>100</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
      <p>host_count=$host_count$</p>
      <p>host_count1 is 1=$host_count1$</p>
      <p>host_count2 catchall=$host_count2$</p>
      <p>gotuniquehost=$gotuniquehost$</p>
    </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <condition match="$result.host_count$ == 1">
              <set token="gotuniquehost">True</set>
              <set token="host_count">$result.host_count$</set>
              <set token="host_count1">$result.host_count$</set>
            </condition>
            <condition>
              <unset token="gotuniquehost"></unset>
              <set token="host_count">$result.host_count$</set>
              <set token="host_count2">$result.host_count$</set>
            </condition>
          </done>
          <query>|stats count as host_count | eval host_count=$number$</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

And yet this is working:

<form>
  <label>TEMP Endpoint Processes Clone</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="number" searchWhenChanged="false">
      <label>Host count</label>
      <default>100</default>
      <initialValue>100</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
      <p>host_count=$host_count$</p>
      <p>host_count1 gt 1=$host_count1$</p>
      <p>host_count2 lt 1=$host_count2$</p>
      <p>host_count3 catchall=$host_count2$</p>
      <p>gotuniquehost=$gotuniquehost$</p>
    </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <done>
            <condition match="$result.host_count$ &gt; 1">
              <unset token="gotuniquehost"></unset>
              <set token="host_count">$result.host_count$</set>
              <set token="host_count1">$result.host_count$</set>
            </condition>
            <condition match="$result.host_count$ &lt; 1">
              <unset token="gotuniquehost"></unset>
              <set token="host_count">$result.host_count$</set>
              <set token="host_count2">$result.host_count$</set>
            </condition>
            <condition>
              <set token="gotuniquehost">True</set>
              <set token="host_count">$result.host_count$</set>
              <set token="host_count3">$result.host_count$</set>
            </condition>
          </done>
          <query>|stats count as host_count | eval host_count=$number$</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

I run splunk enterprise 7.3.3. This seems to be a bug.

Re: Why is my very simple dashboard token condition not working?

vnravikumar — Mon, 24 Feb 2020 12:49:17 GMT

Check this condition <condition match="$result.host_count$ == "1""> it seems you are getting result.host_count as string.

Re: Why is my very simple dashboard token condition not working?

gabriel_vasseur — Mon, 24 Feb 2020 13:47:47 GMT

Thanks, that works!

topic Why is my very simple dashboard token condition not working? in Dashboards & Visualizations

Why is my very simple dashboard token condition not working?

Re: Why is my very simple dashboard token condition not working?

Re: Why is my very simple dashboard token condition not working?