Condition match on another input's token

Corn · ‎05-31-2018

Hi all,

Is there any way to access the token of a sibling input within the condition-match of another input when handling a change? From what I can tell, trying to access the $token$ of another input gives you some kind of empty/null value.

Basic illustration:

...
<fieldset autoRun="true" submitButton="true">
    <input type="text" token="srch_form">
        <label>Search</label>
        <default></default>
    </input>

    <input type="dropdown" token="srch_dropdown">
        <label>Select dropdown</label>
        <default>option1</default>
        <choice value="option1">option1</choice>
        <choice value="option2">option2</choice>

        <change>
            <condition match="len($srch_form$) == 0">
                <set token="temp_token">srch_form length is 0, dropdown value = $value$</set>
            </condition>
            <condition match="len($srch_form$) > 0">
                <set token="temp_token">srch_form length is greater than 0, dropdown value = $value$</set>
            </condition>
        </change>
    </input>
</fieldset>

I can't seem to hit "len($srch_form$) > 0" regardless of what I type in the first text input, so I'm guessing I'm doing something wrong or the capability isn't there.

Thanks for your help!

poete · ‎05-31-2018

Hello.

here is a way to have it functional.

  <init>
    <set token="srch_form_length">0</set>
  </init>
  <fieldset autoRun="true" submitButton="false">
    <input type="text" token="srch_form">
      <label>Search</label>
      <default></default>
      <change>
        <eval token="srch_form_length">len($srch_form$)</eval>
      </change>
    </input>
    <input type="dropdown" token="srch_dropdown">
      <label>Select dropdown</label>
      <default>option1</default>
      <choice value="option1">option1</choice>
      <choice value="option2">option2</choice>
      <change>
        <condition match=" $srch_form_length$ == 0 ">
          <set token="temp_token">srch_form length is 0, dropdown value = $srch_dropdown$</set>
        </condition>
        <condition match=" $srch_form_length$ > 0 ">
          <set token="temp_token">srch_form length is greater than 0, dropdown value = $srch_dropdown$</set>
        </condition>
        <condition match=" 1 > 0">
          <eval token="empty">if(len($srch_form|s$) = 0,"Zero","Non Zero")</eval>
        </condition>
      </change>
    </input>
  </fieldset>

Basically, the length of the first input is computed when it changes, and is set to 0 at init, and this value is used in the match condition.
I could not fix the "len($srch_form$) == 0" case, but I suspect it has to do with this:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/tokens
section Token filters

niketn · ‎05-31-2018

@Corn, please try some of the following changes. I am using <eval> to set the token based on conditions you need. (I have also removed Submit Button and added searchWhenChanged to true to have changed value available immediately on changing respective input.

  <fieldset autoRun="true" submitButton="false">
    <input type="text" token="srch_form" searchWhenChanged="true">
      <label>Search</label>
      <default></default>
    </input>
    <input type="dropdown" token="srch_dropdown" searchWhenChanged="true">
      <label>Select dropdown</label>
      <default>option1</default>
      <choice value="option1">option1</choice>
      <choice value="option2">option2</choice>
      <change>
        <eval token="temp_token">if(isnull($srch_form$) OR $srch_form$="","srch_form length is 0, srch_dropdown= ".$value$,"srch_form not empty =".$srch_form$.", srch_dropdown= ".$value$)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
         <div>srch_form: $srch_form$</div>
         <div>srch_dropdown: $srch_dropdown$</div>
         <div>temp_token: $temp_token$</div>
       </html>
    </panel>
  </row>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Condition match on another input's token

Can’t make it to .conf25? Join us online!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Are you a member of the Splunk Community?

Condition match on another input's token

Can’t make it to .conf25? Join us online!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...