Dashboards & Visualizations

Can you help me set up conditional token using row.host?

coreyf311
Path Finder

In the first panel of a dashboard, a user can click on a host to get more panels to display. One such panel depends on if row.host contains a string. The panel I want depends on $disk$.

<condition>
    <set token="host">$row.host$</set>
</condition>
<condition match="'row.host == &quot;exch-mail*&quot;">
    <set token="disk">true</set>
</condition>

but the panel depending on $disk$ is not working. All the other panels are fine but they are using $host$.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@coreyf311

Can you please try this?

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            </condition>
           <condition>
                <set token="host">$row.host$</set>
            </condition>
        </drilldown>

If you want to toggle your panels then you have to unset tokens. like

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            <unset token="host"></unset>
          </condition>
          <condition>
              <set token="host">$row.host$</set>
              <unset token="disk"></unset>
          </condition>
        </drilldown>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@coreyf311

Can you please try this?

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            </condition>
           <condition>
                <set token="host">$row.host$</set>
            </condition>
        </drilldown>

If you want to toggle your panels then you have to unset tokens. like

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            <unset token="host"></unset>
          </condition>
          <condition>
              <set token="host">$row.host$</set>
              <unset token="disk"></unset>
          </condition>
        </drilldown>

Thanks

0 Karma

coreyf311
Path Finder

exactly how I ended up doing it! thanks for the reply. Figured out the above syntax shortly after posting the question. Not sure why i dont have the option to choose your reply as the accepted answer??

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@coreyf311

I have converted this post as an answer. Please upvote and accept it.

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...