topic Re: Correct syntax for condition in Splunk Search

Correct syntax for condition

greggz — Mon, 19 Feb 2018 16:44:00 GMT

Im trying to perform a condition based on 2 varibles, but I can't seem to get right the expression. I've been trying to chain the conditions, but it doesnt work. What's the equivalent of this:

<change>

            <condition value="volume"> 
                 <condition match=" $token$ != 1">
                    <set token="volume-details1">true</set>
                    <unset token="resptime-details1"></unset>
                    <unset token="error-details1"></unset>
                    <unset token="gctime-details1"></unset>
                    <unset token="thread-details1"></unset>
                    <unset token="connpool-details1"></unset>
                    <unset token="cpu-details1"></unset>
                    <unset token="memory-details1"></unset>
                    <unset token="disk-details1"></unset>
              </condition>
           </condition>

</change>

 <init>
    <set token="token">0</set>
</init>

Re: Correct syntax for condition

kamlesh_vaghela — Mon, 19 Feb 2018 17:20:57 GMT

Hi @greggz,

As your condition is nested can you please try below conditions in your condition code?

 <condition match=" $value$=&quot;volume&quot; AND  $token$ != 1">

Thanks

Re: Correct syntax for condition

greggz — Mon, 19 Feb 2018 17:27:14 GMT

<condition match=" $token$ != 1"> .. This line works fine if it's not inside the Outer condition. So, it's not from that Im sure

Re: Correct syntax for condition

kamlesh_vaghela — Mon, 19 Feb 2018 17:29:28 GMT

oooh..

$token$ is not a input token.?... Can you please share your sample xml ?

Re: Correct syntax for condition

greggz — Mon, 19 Feb 2018 17:37:56 GMT

No. Token is a "global" token.

Re: Correct syntax for condition

kamlesh_vaghela — Mon, 19 Feb 2018 17:59:13 GMT

okay.
I think I missed nested condition tag. Can you please try this?

<condition match=" $value$=&quot;volume&quot; AND  $token$ != 1">

Re: Correct syntax for condition

greggz — Mon, 19 Feb 2018 18:14:49 GMT

Marvelous. It works! Thanks. Update answer for me to mark it as correct. thanks

Re: Correct syntax for condition

kamlesh_vaghela — Mon, 19 Feb 2018 18:17:57 GMT

Answer updated
Please accept and upvote any comment which helped you.
Thanks