topic Re: How can we add token based condition to search query ? in Splunk Search

How can we add token based condition to search query ?

AKG1_old1 — Tue, 29 Sep 2020 13:31:04 GMT

below given is search query and I want to run this query only if token "$Check_Status$" is set to some value. if token "$Check_Status$" is unset then this query should not be run.

Query 1: Can we add condition to this search query? ( example: run if $Check_Status$=LIVE )
Query 2: Can we add multiple condition match something like ( condition match="'job.resultCount'>0" && "$token_xyz$==LIVE")

   <search>
        <query>eventtype=abc sourcetype=vmstat host=$host_name$ | stats earliest(_time) as earliest, latest(_time) as latest</query>
        <earliest>$time_token.earliest$</earliest>
        <latest>$time_token.latest$</latest>
        <finalized>
          <condition match="'job.resultCount'>0">
            <set token="vmstat_earliest_token">$result.earliest$</set>
            <set token="vmstat_latest_token">$result.latest$</set>
          </condition>
          <condition match="'job.resultCount'==0">
            <unset token="vmstat_earliest_token"></unset>
            <unset token="vmstat_latest_token"></unset>
          </condition>
        </finalized>
      </search>

Re: How can we add token based condition to search query ?

niketn — Mon, 03 Apr 2017 14:04:06 GMT

@agoyal... how are you setting Check_Status? Is that through check box or radio button? You can set your entire search string in change event.

Re: How can we add token based condition to search query ?

AKG1_old1 — Mon, 03 Apr 2017 14:12:57 GMT

Check_Status is set through drill down in a table content.

 <table id="table1">
        <search>
           <query> Query </query>
          <earliest>-150d@d</earliest>
          <latest>now</latest>`enter code here`
        </search>
        <drilldown>
           <set token="Check_Status">LOG_DROP</set>
       </drilldown>
        <option name="count">9</option>
        <option name="drilldown">cell</option>
      </table>

Re: How can we add token based condition to search query ?

woodcock — Mon, 11 Sep 2017 02:06:14 GMT

You can set a new token based on an existing token like this: <eval token="conditionMATCH">if(($job.resultCount'>0" AND "$token_xyz$==LIVE"), "YES", null()</eval>. You can use depends to hide/execute an entire panel (and the search inside it) based on whether a token is set.