Can you help me set up conditional token using row.host?

[coreyf311]

In the first panel of a dashboard, a user can click on a host to get more panels to display. One such panel depends on if row.host contains a string. The panel I want depends on $disk$.

<condition>
    <set token="host">$row.host$</set>
</condition>
<condition match="'row.host == &quot;exch-mail*&quot;">
    <set token="disk">true</set>
</condition>

but the panel depending on $disk$ is not working. All the other panels are fine but they are using $host$.

[kamlesh_vaghela · Accepted solution]

@coreyf311

Can you please try this?

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            </condition>
           <condition>
                <set token="host">$row.host$</set>
            </condition>
        </drilldown>

If you want to toggle your panels then you have to unset tokens. like

<drilldown>
           <condition match="like('row.host',&quot;exch-mail%&quot;)">
            <set token="disk">true</set>
            <unset token="host"></unset>
          </condition>
          <condition>
              <set token="host">$row.host$</set>
              <unset token="disk"></unset>
          </condition>
        </drilldown>

Thanks

[coreyf311]

exactly how I ended up doing it! thanks for the reply. Figured out the above syntax shortly after posting the question. Not sure why i dont have the option to choose your reply as the accepted answer??

[kamlesh_vaghela]

@coreyf311

I have converted this post as an answer. Please upvote and accept it.

Happy Splunking