topic Re: How to unset an input token when value isn't the default in Splunk Search

How to unset an input token when value isn't the default

vshakur — Wed, 16 Aug 2017 14:57:30 GMT

I have the following xml code:

   <change>
        <condition value="default_value">
           <unset token="some_token"></unset>
        </condition>
   </change>

I would like to unset some_token only when value DOESN'T equal "default_value".
I tried: condition value!="default_value" but it doesn't work and I get an error.

Thank you,
Samuel

Re: How to unset an input token when value isn't the default

sbbadri — Tue, 29 Sep 2020 15:22:29 GMT

try this

Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens

Re: How to unset an input token when value isn't the default

vshakur — Wed, 16 Aug 2017 15:42:07 GMT

It seems to be the right direction.
I just don't understand what should be the fieldname.
Should it be $current_token$? or a field from the input's search query?

Re: How to unset an input token when value isn't the default

sbbadri — Wed, 16 Aug 2017 15:52:29 GMT

You need to use field from query. You haven't posted previous lines above change tag. So that i have mentioned as fieldname

Re: How to unset an input token when value isn't the default

vshakur — Wed, 16 Aug 2017 15:54:29 GMT

Great, thanks!