Dashboards & Visualizations

Can you help me set up conditional token using row.host?

coreyf311
Path Finder

In the first panel of a dashboard, a user can click on a host to get more panels to display. One such panel depends on if row.host contains a string. The panel I want depends on $disk$.

<condition>
    <set token="host">$row.host$</set>
</condition>
<condition match="'row.host == &quot;exch-mail*&quot;">
    <set token="disk">true</set>
</condition>

but the panel depending on $disk$ is not working. All the other panels are fine but they are using $host$.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@coreyf311

Can you please try this?

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            </condition>
           <condition>
                <set token="host">$row.host$</set>
            </condition>
        </drilldown>

If you want to toggle your panels then you have to unset tokens. like

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            <unset token="host"></unset>
          </condition>
          <condition>
              <set token="host">$row.host$</set>
              <unset token="disk"></unset>
          </condition>
        </drilldown>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@coreyf311

Can you please try this?

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            </condition>
           <condition>
                <set token="host">$row.host$</set>
            </condition>
        </drilldown>

If you want to toggle your panels then you have to unset tokens. like

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            <unset token="host"></unset>
          </condition>
          <condition>
              <set token="host">$row.host$</set>
              <unset token="disk"></unset>
          </condition>
        </drilldown>

Thanks

0 Karma

coreyf311
Path Finder

exactly how I ended up doing it! thanks for the reply. Figured out the above syntax shortly after posting the question. Not sure why i dont have the option to choose your reply as the accepted answer??

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@coreyf311

I have converted this post as an answer. Please upvote and accept it.

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...