Condition value NOT equal to....whatever

dbcase — Thu, 07 Dec 2017 17:30:36 GMT

Hi,

I have this XML code. What I'm trying to do is when the value = *, run a separate query and when the value is anything else but * run a different query. I'm having difficulty figuring out how to configure condition value to be not equal to *

 <input type="dropdown" token="mso_selection" searchWhenChanged="true">
      <label>Select a MSO</label>
      <search>
        <query>index=wholesale_app  sourcetype=wholesale_mobile_app buildTarget | dedup buildTarget</query>
        <earliest>-1d</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>buildTarget</fieldForLabel>
      <fieldForValue>buildTarget</fieldForValue>
      <choice value="*">- All -</choice>
      <default>*</default>
      <initialValue>*</initialValue>

      <change>
         <condition value="*">
           <set token="tokSearchQueryPanel1">index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |rex "\d+\s(?<mso>\w+)"|stats max(stat_val) as Subscribers by mso|stats sum(Subscribers) as count</set>
           <unset token="tokSearchQueryPanel2"></unset>
         </condition>

         <condition value"*">     (this line is what I'm trying to figure out)

           <set token="tokSearchQueryPanel2">index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |rex "\d+\s(?&lt;mso&gt;\w+)"|stats max(stat_val) as Subscribers by mso|where like(mso,"%$mso_selection$%") |stats sum(Subscribers) as count</set>
           <unset token="tokSearchQueryPanel1"></unset>
         </condition>
       </change>

    </input>

Re: Condition value NOT equal to....whatever

niketn — Thu, 07 Dec 2017 17:50:52 GMT

@dbcase, you can just use a condition block without any match expression. This servers as else condition.

      <condition value="*">
             <-- Your Code For Value Matching Asterix -->
      </condition>
      <condition>
             <--  Your Code For All Other Values not matching Asterix -->
      </condition>

Refer to one of my comments in my previous answer on similar question: https://answers.splunk.com/answers/596673/how-can-i-get-the-value-of-a-token-as-a-search-eva.html

Re: Condition value NOT equal to....whatever

woodcock — Thu, 07 Dec 2017 17:58:19 GMT

Condition on label="All" instead.

topic Condition value NOT equal to....whatever in Splunk Search

Condition value NOT equal to....whatever

Re: Condition value NOT equal to....whatever

Re: Condition value NOT equal to....whatever