topic Re: problem with 'condition match' in Splunk Search

problem with 'condition match'

gerbert — Sat, 27 Mar 2021 12:36:13 GMT

Hello,

I want to conduct a search, set a token according to the search result and then set another bunch of tokens depending on the search result token.
However my tokens ($test1$, $test2$ and $test3$) get never set. Any ideas what I'm doing wrong?

<dashboard> <label>Titel</label> <row> <panel depends="$alwaysHideCSS$"> <single> <search> <query> index=someSearch| rename searchResult AS XX </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <set token="testtest">$result.XX$</set> </done> </search> <drilldown> <condition match="5==5"> <set token="test1">X5</set> <set token="test2">a</set> <set token="test3">b</set> </condition> <condition match="1==9"> <set token="test1">a</set> <set token="test2">X2</set> <set token="test3">b</set> </condition> <condition match="2==3"> <set token="test1">a</set> <set token="test2">b</set> <set token="test3">X3</set> </condition> </drilldown> </single> </panel> </row> [... ]  </dashboard>

The token "testtest" is working. Why do the tokens ($test1$, $test2$ and $test3$) not get set? The condition "5==5" cannot be false.

Re: problem with 'condition match'

ITWhisperer — Sat, 27 Mar 2021 12:59:50 GMT

Perhaps a silly question, but you are clicking on the single, right?

Re: problem with 'condition match'

gerbert — Sat, 27 Mar 2021 17:14:33 GMT

Oh, no. I wasn't. Thanks! Now it set's the tokens correctly but is it possible to do this automatically without having to click anything. Like in an <init> </init> environment. If so could you give me an example of how you would do it?

On a side note: is there a way to delete your own community posts? Earlier there was a problem with the splunk community servers I think, which lead to me posting five different threads with the same topic.

Re: problem with 'condition match'

gerbert — Sat, 27 Mar 2021 17:23:05 GMT

Just to clarify I don't even need/want the <single>. I just added it because otherwise I couldn't use the drilldown with the different conditions.
I want to conduct a search (automatically as soon as the dashboard is loaded), set a token with the search result as a value and then depending on that value I want to set a bunch of other tokens.

Re: problem with 'condition match'

ITWhisperer — Sat, 27 Mar 2021 18:00:51 GMT

<form theme="light"> <label>...</label> <search id="xyz"> <query>index=...</query> <earliest>-7d@h</earliest> <latest>@h</latest> <done> <condition> <set token="blah">blah</set> </condition> </done> </search> <init> <set token="abc">true</set> </init> <fieldset submitButton="false"></fieldset> <row>

Re: problem with 'condition match'

ITWhisperer — Sat, 27 Mar 2021 18:03:13 GMT

If you need to set tokens to different values depending on the results, you can use things like

Re: problem with 'condition match'

ITWhisperer — Sat, 27 Mar 2021 18:05:42 GMT

Look for this dropdown menu at the top of your post

You may be able to remove the post from there