topic Re: Problem with Token condition match in Dashboards & Visualizations

Problem with Token condition match

llacoste — Tue, 10 Nov 2020 17:57:36 GMT

Hi,

I am trying to set a token to display a part of my dashboard only if the value of one of the field I've got in my search is equal to a certain string.

Here is an example:

<search> <query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false"))</query> <done> <condition match="'result.is_Valid'==true"> <set token="Display_Html">true</set> </condition> </done> </search>

However, this condition doesn't seem to work. I can clearly see my makeresults command works in a search or even in the dashboard, but the condition + set token doesn't seem to work.

Does anybody have got any idea what I'm doing wrong please?

Thank you

Regards

Laurent

Re: Problem with Token condition match

richgalloway — Tue, 10 Nov 2020 19:14:28 GMT

What version of Splunk are you using? This code works find under 8.1.

<dashboard> <label>test2</label> <row> <panel> <table> <search> <query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false"))</query> <done> <condition match="'result.is_Valid'==true"> <set token="Display_Html">true</set> </condition> </done> </search> </table> </panel> </row> </dashboard>

Re: Problem with Token condition match

llacoste — Tue, 10 Nov 2020 20:26:51 GMT

Hi,

Thank you for your time. I am working with 7.3.5 (don't have the choice) and it did not seem to work.

I'll check in a separate test dashboard at work tomorrow and on a fresh install of v8.x tonight.

Thank you for your time. Will let you know ASAP.

Regards.

Re: Problem with Token condition match

llacoste — Tue, 10 Nov 2020 21:02:24 GMT

Just tried on v8.0.4.1 and it's still not working.

I manage to get that field is_OK populated but the second token in the condition doesn't get set.

Re: Problem with Token condition match

bowesmana — Tue, 10 Nov 2020 21:28:37 GMT

@llacoste

You need to quote the right hand side of the condition, true, with " so it should be

<search> <query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false")). </query> <done> <condition match="'result.is_Valid'=="true""> <set token="Display_Html">true</set> </condition> </done> </search>

Re: Problem with Token condition match

llacoste — Wed, 11 Nov 2020 11:01:24 GMT

Hi,

So I had some play around this at work this morning and it seems if I'm using a test dashboard with nothing else on version 7.3.5, it does work.

However as my other dashboard is more complex and one of the field I'm testing depends on another query, I guess that's the problem. Maybe Splunk is loading at the same time both queries and the condition is not possible as the first query is still not completed yet.

I am using <done> tags on both queries which should make it work but it seems not.
I'm going to explore the idea of only triggering the second search only if the first one is completed.

Thank you for your help @richgalloway and @bowesmana at least you proved it should be working.

Re: Problem with Token condition match

llacoste — Wed, 11 Nov 2020 11:43:07 GMT

And finally I just managed to understand and make it work.

I was testing the token on a <html><h1>$Display_Html$</h1></html> part of the dashboard, however this was loading before the search managed to finish and set the token.

I used a depends="$Display_Html$" and now the panel only appears whenever the token had time to be set.

Bottom line it must have been working for a while but couldn't see the token being set.

Also the " seems to make it work.

Thank you again. Problem solved!

Re: Problem with Token condition match

richgalloway — Wed, 11 Nov 2020 14:05:48 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.