topic Re: if then else dashboard help in Dashboards & Visualizations

if then else dashboard help

sgro777 — Sat, 24 Aug 2024 15:46:10 GMT

I'm very new to Splunk. I have two tokens as input to a dashboard and want to change a query based on which one is entered.

My base query (with no dashboard)

eventtype=builder user_id IN (<value1>, <value2>, etc.) | eval .....

I created a dashboard and want to use tokens for the input.

token1=$id$ token2=$email$

If the token1 has data, I want to execute

eventtype=builder user_id IN ($id$) | eval....

otherwise, I want to execute

eventtype=builder user_mail in $email$ | eval .....

Re: if then else dashboard help

gcusello — Sat, 24 Aug 2024 05:23:38 GMT

Hi @sgro777 ,

did you tried with:

eventtype=builder (user_id IN ($id$) OR user_mail in $email$) | eval .....

Ciao.

Giuseppe

Re: if then else dashboard help

ITWhisperer — Sat, 24 Aug 2024 08:39:50 GMT

Your issue may be to do with what you do if the user has not selected a value for either token. A dashboard would normal wait for the user to make a selection. Handling tokens is easier in Classic SimpleXML dashboards than currently available in Studio. Is this an option for you?

Re: if then else dashboard help

sgro777 — Tue, 27 Aug 2024 19:00:43 GMT

I tried this but it would not work.

eventtype=builder (user_id IN ($id$) OR user_mail in $email$)
| eval .....

I also tried eventtype=builder ((user_id IN ($id$) OR (user_mail IN ($email$))) | eval ... but that only works if both tokens are populated.

Re: if then else dashboard help

sgro777 — Tue, 27 Aug 2024 19:03:56 GMT

If I can't figure it out, I'll try the simple dashboard.

Re: if then else dashboard help

gcusello — Wed, 28 Aug 2024 06:17:43 GMT

Hi @sgro777 ,

sorry, my error, please try:

eventtype=builder (user_id IN ($id$) OR user_mail IN ($email$)) | eval ...

Ciao.

Giuseppe

Re: if then else dashboard help

sgro777 — Fri, 30 Aug 2024 16:31:47 GMT

THANK YOU!

Re: if then else dashboard help

gcusello — Mon, 02 Sep 2024 07:49:14 GMT

Hi @sgro777 ,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉