topic Re: If statemnt not working with Tokens in dashboard in Dashboards & Visualizations

If statement not working with Tokens in dashboard

lokeshchanana — Tue, 29 Jul 2025 05:52:20 GMT

I am making a dashboard with the dropdown input called $searchCriteria$. I am trying to set the value of a search_col based on the value of the $searchCriteria$ token. I have tried the following:

| eval search_col = if($searchcriteria$ == "s_user", user, path)

| eval search_col = if('$searchcriteria$' == "s_user", user, path)

| eval search_col = if($searchcriteria$ == 's_user', user, path)

| eval search_col = if('$searchcriteria$' == 's_user', user, path)

Even tried

| eval search_col = if(s_user == s_user, user, path)

The value of search_col is the same as path.
I have tested, and the value of the $searchcriteria$ is getting set properly.
What am I doing wrong?

Re: If statemnt not working with Tokens in dashboard

PrewinThomas — Tue, 29 Jul 2025 04:23:49 GMT

@lokeshchanana

Simple XML tokens are case-sensitive. You must use $searchCriteria$—matching the capitalization in your input name

| eval search_col = if("$searchCriteria$"=="s_user", user, path)

Also you can use case() with token substitution,

| eval search_col = case("$searchCriteria$"=="s_user", user, 1==1, path)

This forces Splunk to treat "$searchCriteria$" as a string literal and compare it properly.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: If statemnt not working with Tokens in dashboard

ITWhisperer — Tue, 29 Jul 2025 05:53:14 GMT

Almost! Yes, using the correct case for the token is vital, but it is putting the token in double quotes which is also vital. Using case instead of if is not important.

Token values are substituted as a text substitution into the code of the dashboard (whether Studio or SimpleXML) before the dashboard code is executed. For example, if the searchCriteria token from the dropdown had the value "s_user", the

| eval search_col = if($searchCriteria$ == "s_user", user, path)

line would become

| eval search_col = if(s_user == "s_user", user, path)

i.e. if the s_user field has the string value "s_user". Using double quotes

| eval search_col = if("$searchCriteria$" == "s_user", user, path)

gives the line the intended meaning

| eval search_col = if("s_user" == "s_user", user, path)

Re: If statement not working with Tokens in dashboard

livehybrid — Tue, 29 Jul 2025 06:24:51 GMT

Hi @lokeshchanana

Case sensitivity of the token is certainly causing you an issue here, if the token you're setting is "searchCriteria" then your cannot use "searchcriteria".

Also, you can use Token filters to add quotes around the token if you prefer, so

| eval search_col = if($searchCriteria|s$ == "s_user", user, path)

should also be the same as:

| eval search_col = if("$searchCriteria$" == "s_user", user, path)

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: If statement not working with Tokens in dashboard

ITWhisperer — Tue, 29 Jul 2025 06:52:32 GMT

Strictly speaking, "$searchCriteria$" is not the same as $searchCriteria|s$ as the |s filter will deal with things such as embedded quotes, whereas just putting the token in double quotes will not. Having said that, in this instance, they are probably equivalent.

Re: If statement not working with Tokens in dashboard

lokeshchanana — Tue, 29 Jul 2025 21:10:40 GMT

I am sorry for the typing mistake. The Token name is searchcriteria, there is no difference in the case:

I know case difference is an issue, but I have made sure there is no case difference, and I am still having the same issue.

Re: If statement not working with Tokens in dashboard

lokeshchanana — Tue, 29 Jul 2025 21:12:58 GMT

Thanks for your reply. I have checked the case and for the special characters, I even changed the token name from search_criteria to searchcriteria

Re: If statement not working with Tokens in dashboard

ITWhisperer — Tue, 29 Jul 2025 22:02:14 GMT

What exactly is not working? Please share your search where you are using the token?