Hey,
I have a dashboard for which I want to set a value based on whether a string matches a smoke test. This is the XML I have:
<change>
<condition value="*smoke*">
<set token="testUrl">http://someUrl</set>
</condition>
<condition value="*">
<set token="testUrl">http://someOtherUrl</set>
</condition>
</change>
The change condition doesn't seem to respect asterisk wildcards though. It's always directing to http://someOtherUrl. Is there a way to get this to work?
In 6.3 I put the following xml together that performs a test like you describe:
<form>
<label>Test_smoke</label>
<fieldset>
<input type="text" token="field100">
<change>
<condition match="match(value, "smoke")">
<set token="test-result">Is_smoke</set>
</condition>
<condition>
<set token="test-result">Is_NOT_smoke</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Test-Result=$test-result$ ------ field=$field100$ </title>
<search>
<query>index=**</query>
<earliest>0</earliest>
</search>
</table>
</panel>
</row>
</form>
Hi
Can you please try this?
<change>
<condition match="like($value$,"%smoke%")">
<set token="testUrl">http://someUrl</set>
</condition>
<condition value="*">
<set token="testUrl">http://someOtherUrl</set>
</condition>
</change>
Here I have used like()
in match.
eg,
like($value$,"%smoke%")
Happy Splunking
hi am also searching for this type of problem please help for this .my question links are::
https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html
https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html
this worked for me
In 6.3 I put the following xml together that performs a test like you describe:
<form>
<label>Test_smoke</label>
<fieldset>
<input type="text" token="field100">
<change>
<condition match="match(value, "smoke")">
<set token="test-result">Is_smoke</set>
</condition>
<condition>
<set token="test-result">Is_NOT_smoke</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Test-Result=$test-result$ ------ field=$field100$ </title>
<search>
<query>index=**</query>
<earliest>0</earliest>
</search>
</table>
</panel>
</row>
</form>
Yeah, this feature came new with 6.3... nice find!
Hi All,
I am also looking for this issue.
am using like this what did you gave answers.
ALL
But is is not working for me am using splunk 6.6.1
It is working this code
ALL
It is ok but what my problem is ...
This code working good in desktop but it is not working in mobiles.
please help for this .
my question link; link text
hi am also searching for this type of problem please help for this .my question links are::
https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html
https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html
The reference doesn't say anything about wildcards, it only specifies *
as a setting to apply this to every input value
element, i.e. that this condition is independent of the value that the input has changed to (which would be the same as not having the condition at all). Therefore, it's no wonder that your code above always responds with someOtherUrl, as the second condition is always met.
I doubt the conditions are tried in the order they appear and stop when a match has been found, which would be a case
-like behavior; I would expect all conditions to be tried and if the result a condition produces overlaps with that of a previously tried condition (as with the token "testUrl" in your case), I would expect it to overwrite the previously set value. But this is only speculation at the moment, I will see and try if I can figure that out.
In the meantime, have you tried using two exclusive, more excplicit values, something like
<change>
<condition value="*smokeA*">
<set token="testUrl">http://someUrl</set>
</condition>
<condition value="*smokeB*">
<set token="testUrl">http://someOtherUrl</set>
</condition>
</change>
I'm not sure about this, but if those values take wildcards, this might work because they only ever apply one at a time.
In any case, you should be able to do what you want with Javascript: listen to a change event on the input, check the value for your condition, and set the token accordingly.
UPDATE: In fact, conditions do behave case-like. If you let them check something explicitly, i.e. full text match, only the first condition's action is applied, so you can use that condition with value=* as the last condtion, after all others did not match, kind of like the 1=1 condition in a case statement.
From what I can tell, the conditional isn't respecting wildcards. My guess is that the value="*"
option is a special case that Splunk handles. It's not indicative of it accepting wildcards.
Unfortunately this means I'll have to edit the javascript or find a different workaround. But let me know if anyone else finds a good way to do this!
Yes, it would seem that unfortunately, wildcards are not supported in these value condition checks.