I wanted to build a dashboard that displays some panels only depending on the selection for the drilldown. My approach was the following, but for some reason the condition match is not generating any tokens.
Thanks in advance for your help!
<query>index=myindex | timechart count by type</query>
<condition match="$click.name2$ == type_1">
<condition match="$click.name2$ == type_2">
'click.name2' == "type_2"
I've had mixed results using $ for tokens. Use single quotes instead. You also need encoded quotes for the literal value.
View solution in original post
Note for those that are trying to use 'trellis.name' or 'trellis.value'. It doesn't work at the moment (Splunk 7.0.2).