Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Condition match on another input's token
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Condition match on another input's token
Hi all,
Is there any way to access the token of a sibling input within the condition-match of another input when handling a change? From what I can tell, trying to access the $token$ of another input gives you some kind of empty/null value.
Basic illustration:
...
<fieldset autoRun="true" submitButton="true">
<input type="text" token="srch_form">
<label>Search</label>
<default></default>
</input>
<input type="dropdown" token="srch_dropdown">
<label>Select dropdown</label>
<default>option1</default>
<choice value="option1">option1</choice>
<choice value="option2">option2</choice>
<change>
<condition match="len($srch_form$) == 0">
<set token="temp_token">srch_form length is 0, dropdown value = $value$</set>
</condition>
<condition match="len($srch_form$) > 0">
<set token="temp_token">srch_form length is greater than 0, dropdown value = $value$</set>
</condition>
</change>
</input>
</fieldset>
I can't seem to hit "len($srch_form$) > 0" regardless of what I type in the first text input, so I'm guessing I'm doing something wrong or the capability isn't there.
Thanks for your help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello.
here is a way to have it functional.
<init>
<set token="srch_form_length">0</set>
</init>
<fieldset autoRun="true" submitButton="false">
<input type="text" token="srch_form">
<label>Search</label>
<default></default>
<change>
<eval token="srch_form_length">len($srch_form$)</eval>
</change>
</input>
<input type="dropdown" token="srch_dropdown">
<label>Select dropdown</label>
<default>option1</default>
<choice value="option1">option1</choice>
<choice value="option2">option2</choice>
<change>
<condition match=" $srch_form_length$ == 0 ">
<set token="temp_token">srch_form length is 0, dropdown value = $srch_dropdown$</set>
</condition>
<condition match=" $srch_form_length$ > 0 ">
<set token="temp_token">srch_form length is greater than 0, dropdown value = $srch_dropdown$</set>
</condition>
<condition match=" 1 > 0">
<eval token="empty">if(len($srch_form|s$) = 0,"Zero","Non Zero")</eval>
</condition>
</change>
</input>
</fieldset>
Basically, the length of the first input is computed when it changes, and is set to 0 at init, and this value is used in the match condition.
I could not fix the "len($srch_form$) == 0" case, but I suspect it has to do with this:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/tokens
section Token filters
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Corn, please try some of the following changes. I am using <eval> to set the token based on conditions you need. (I have also removed Submit Button and added searchWhenChanged to true to have changed value available immediately on changing respective input.
<fieldset autoRun="true" submitButton="false">
<input type="text" token="srch_form" searchWhenChanged="true">
<label>Search</label>
<default></default>
</input>
<input type="dropdown" token="srch_dropdown" searchWhenChanged="true">
<label>Select dropdown</label>
<default>option1</default>
<choice value="option1">option1</choice>
<choice value="option2">option2</choice>
<change>
<eval token="temp_token">if(isnull($srch_form$) OR $srch_form$="","srch_form length is 0, srch_dropdown= ".$value$,"srch_form not empty =".$srch_form$.", srch_dropdown= ".$value$)</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<html>
<div>srch_form: $srch_form$</div>
<div>srch_dropdown: $srch_dropdown$</div>
<div>temp_token: $temp_token$</div>
</html>
</panel>
</row>
| makeresults | eval message= "Happy Splunking!!!"
What the End of Support for Splunk Add-on Builder Means for You
Solve, Learn, Repeat: New Puzzle Channel Now Live
Building Reliable Asset and Identity Frameworks in Splunk ES
