topic Re: Want to condition match when a value is a single asterisk in Splunk Search

Want to condition match when a value is a single asterisk

simpkins1958 — Thu, 08 Feb 2018 21:06:57 GMT

Have tried every combination I can think of. Want to set some tokens in a when the value is a single asterisk.

As an exampl this does not work. The condition is matched for everything but a blank field.

<condition match="match(userSearchToken,&quot;\*&quot;)">

Re: Want to condition match when a value is a single asterisk

simpkins1958 — Thu, 08 Feb 2018 21:09:38 GMT

Here is a complete example that is not working. When enter a value that is not a single asterisk the match still executes.

    <input type="text" token="deviceSearchToken" searchWhenChanged="true">
      <label>Device:</label>
      <default>*</default>
        <change>
          <condition match="match(deviceSearchToken, &quot;&#92;*&quot;)">
            <set token="filterDeviceToken"></set>
            <set token="deviceDrilldownToken"></set>
          </condition>
          <condition>
            <set token="filterDeviceToken">nmds_app_dest_survey.d_name=$value|s$</set>
            <set token="deviceDrilldownToken">&amp;form.deviceToken=$value|u$</set>            
          </condition>
        </change>      
    </input>

Re: Want to condition match when a value is a single asterisk

elliotproebstel — Thu, 08 Feb 2018 21:49:47 GMT

How about this structure instead:

    <input type="text" token="deviceSearchToken" searchWhenChanged="true">
      <label>Device:</label>
      <default>*</default>
      <change>
        <eval token="filterDeviceToken">if($deviceSearchToken$="*", "ASTERISK", "NOT ASTERISK")</eval>
        <eval token="deviceDrilldownToken">if($deviceSearchToken$="*", "ASTERISK2", "NOT ASTERISK2")</eval>
      </change>
    </input>

You'll need to replace "ASTERISK"/"NOT ASTERISK" with the values you actually want to use there, but I'm confused about what your intentions are for those, as the structure you're using inside the <set> elements above isn't really clear to me.

Re: Want to condition match when a value is a single asterisk

elliotproebstel — Thu, 08 Feb 2018 21:52:35 GMT

Here's a full test dashboard that you could use to validate:

<form>
  <label>test_match</label>
  <fieldset submitButton="false">
    <input type="text" token="deviceSearchToken" searchWhenChanged="true">
      <label>Device:</label>
      <default>*</default>
      <change>
        <eval token="filterDeviceToken">if($deviceSearchToken$="*", "ASTERISK", "NOT ASTERISK")</eval>
        <eval token="deviceDrilldownToken">if($deviceSearchToken$="*", "ASTERISK2", "NOT ASTERISK2")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| stats count | eval first="$filterDeviceToken$", second="$deviceDrilldownToken$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Re: Want to condition match when a value is a single asterisk

simpkins1958 — Fri, 09 Feb 2018 04:05:12 GMT

Was able to get it working with this XML:

    </input>
     <input type="text" token="deviceToken" searchWhenChanged="true">
       <label>Device:</label>
       <default>*</default>
       <change>
           <condition match="$value$==&quot;*&quot;">
             <set token="filterDeviceToken"></set>
           </condition>
           <condition>
             <set token="filterDeviceToken">nmds_app_dest_survey.d_name=$value|s$</set>
           </condition> 
       </change>      
     </input>

Re: Want to condition match when a value is a single asterisk

Kenshiro70 — Tue, 19 Jun 2018 21:29:20 GMT

You might want to consider changing $filterDeviceToken$ to $value$ . If prefix or suffix is defined, the full token will include them, whereas the value token will return only what's in the input.