https://community.splunk.com/t5/Splunk-Search/How-to-set-variable-based-on-token-value/m-p/590873#M205699 <P>I'm looking to set a variable (customerLabel) depending on whether the user selects "framework" or "team" from a dropdown list. The token set with the dropdown is $grouping-name$. Where am I going wrong as customerLabel is not being set with a value at all.</P> <P>&nbsp;</P> <P>I've included a snippet of the code below:</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">| eval teamCustomerLabel=case(issueLabel="customer1", "Customer 1", issueLabel="customer2", "Customer 2", issueLabel="customer3", "Customer 3", issueLabel="customer4", "Customer 4", issueLabel="customer5", "Customer 5", issueLabel="customer6", "Customer 6") | eval frameworkCustomerLabel=case(issueLabel="customer1", "Group 1", issueLabel="customer2", "Group 1", issueLabel="customer3", "Group 2", issueLabel="customer4", "Group 2", issueLabel="customer5", "Group 3", issueLabel="customer6", "Group 3") | eval customerLabel=case("$grouping-name$"=="framework", frameworkCustomerLabel, "$grouping-name$"=="team", teamCustomerLabel) | chart count(key) as "Created" over _time by customerLabel where top 50</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 25 Mar 2022 18:56:55 GMT anthonyb90 2022-03-25T18:56:55Z https://community.splunk.com/t5/Splunk-Search/How-to-set-variable-based-on-token-value/m-p/590873#M205699 <P>I'm looking to set a variable (customerLabel) depending on whether the user selects "framework" or "team" from a dropdown list. The token set with the dropdown is $grouping-name$. Where am I going wrong as customerLabel is not being set with a value at all.</P> <P>&nbsp;</P> <P>I've included a snippet of the code below:</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">| eval teamCustomerLabel=case(issueLabel="customer1", "Customer 1", issueLabel="customer2", "Customer 2", issueLabel="customer3", "Customer 3", issueLabel="customer4", "Customer 4", issueLabel="customer5", "Customer 5", issueLabel="customer6", "Customer 6") | eval frameworkCustomerLabel=case(issueLabel="customer1", "Group 1", issueLabel="customer2", "Group 1", issueLabel="customer3", "Group 2", issueLabel="customer4", "Group 2", issueLabel="customer5", "Group 3", issueLabel="customer6", "Group 3") | eval customerLabel=case("$grouping-name$"=="framework", frameworkCustomerLabel, "$grouping-name$"=="team", teamCustomerLabel) | chart count(key) as "Created" over _time by customerLabel where top 50</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 25 Mar 2022 18:56:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-variable-based-on-token-value/m-p/590873#M205699 anthonyb90 2022-03-25T18:56:55Z https://community.splunk.com/t5/Splunk-Search/How-to-set-variable-based-on-token-value/m-p/590904#M205710 <P>Set the values in your dropdown</P><LI-CODE lang="markup">&lt;option value="frameworkCustomerLabel"&gt;framework&lt;/option&gt; &lt;option value="teamCustomerLabel"&gt;team&lt;/option&gt;</LI-CODE><P>and use the token in the search</P><LI-CODE lang="markup">| eval teamCustomerLabel=case(issueLabel="customer1", "Customer 1", issueLabel="customer2", "Customer 2", issueLabel="customer3", "Customer 3", issueLabel="customer4", "Customer 4", issueLabel="customer5", "Customer 5", issueLabel="customer6", "Customer 6") | eval frameworkCustomerLabel=case(issueLabel="customer1", "Group 1", issueLabel="customer2", "Group 1", issueLabel="customer3", "Group 2", issueLabel="customer4", "Group 2", issueLabel="customer5", "Group 3", issueLabel="customer6", "Group 3") | chart count(key) as "Created" over _time by $grouping-name$ where top 50</LI-CODE> Fri, 25 Mar 2022 16:58:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-variable-based-on-token-value/m-p/590904#M205710 ITWhisperer 2022-03-25T16:58:48Z