Help putting a condition match for a search with three possible results to show/hide either both or one of two panels

jaffar20 — Fri, 20 Sep 2019 15:30:32 GMT

I'm trying to either hide or show two panels depending on a search result from a different panel which will have 3 options.

E.g. If the result is "A" I want both panels to show, If "B" then just one panel, and if "C" then just the other panel.

I don't want to use my actual search in case a google search leads to my companies product but I've done the condition that the other panel is dependant on like this:

<condition match="'Letter' == &quot;A&quot;">
  <set token="show_panel_1">true</set>
  <set token="show_panel_2">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>
</condition>
<condition match="'Letter' == &quot;B&quot;">
  <set token="show_panel_1">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>
</condition>
<condition match="'Letter' == &quot;C&quot;">
  <set token="panel_show_2">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>`

And the panels two panels are done as,

<panel depends="$show_panel_1$">

and

<panel depends="$show_panel_2$">

However, both panels are hidden regardless of the result. What did I do wrong? I've seen other examples online used the unset so that's why I used it, but even when I try removing it or just putting it at the end, it still doesn't work.

Re: Help putting a condition match for a search with three possible results to show/hide either both or one of two panels

jaffar20 — Mon, 23 Sep 2019 14:03:32 GMT

Solved it: it was the field name being in quotes

topic Help putting a condition match for a search with three possible results to show/hide either both or one of two panels in Splunk Search

Help putting a condition match for a search with three possible results to show/hide either both or one of two panels

Re: Help putting a condition match for a search with three possible results to show/hide either both or one of two panels