Dashboards & Visualizations

Dropdown Condition - Match regex value on change

bruceclarke
Contributor

Hey,

I have a dashboard for which I want to set a value based on whether a string matches a smoke test. This is the XML I have:

<change>
    <condition value="*smoke*">
        <set token="testUrl">http://someUrl</set>
    </condition>
    <condition value="*">
        <set token="testUrl">http://someOtherUrl</set>
    </condition>
</change>

The change condition doesn't seem to respect asterisk wildcards though. It's always directing to http://someOtherUrl. Is there a way to get this to work?

0 Karma
1 Solution

mydog8it
Builder

In 6.3 I put the following xml together that performs a test like you describe:

    <form>
     <label>Test_smoke</label>
      <fieldset>
       <input type="text" token="field100">
        <change>
         <condition match="match(value, &quot;smoke&quot;)">
          <set token="test-result">Is_smoke</set>
         </condition>
         <condition>
          <set token="test-result">Is_NOT_smoke</set>
         </condition>
        </change>
       </input>
      </fieldset>
      <row>
       <panel>
        <table>
         <title>Test-Result=$test-result$ ------ field=$field100$ </title>
          <search>
           <query>index=**</query>
           <earliest>0</earliest>
          </search>
         </table>
        </panel>
       </row>
    </form>

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

Can you please try this?

<change>
         <condition match="like($value$,&quot;%smoke%&quot;)">
             <set token="testUrl">http://someUrl</set>
         </condition>
         <condition value="*">
             <set token="testUrl">http://someOtherUrl</set>
         </condition>
     </change>

Here I have used like() in match.

eg,

like($value$,&quot;%smoke%&quot;)

Happy Splunking

harishalipaka
Motivator
0 Karma

rajpannala
Engager

this worked for me

0 Karma

mydog8it
Builder

In 6.3 I put the following xml together that performs a test like you describe:

    <form>
     <label>Test_smoke</label>
      <fieldset>
       <input type="text" token="field100">
        <change>
         <condition match="match(value, &quot;smoke&quot;)">
          <set token="test-result">Is_smoke</set>
         </condition>
         <condition>
          <set token="test-result">Is_NOT_smoke</set>
         </condition>
        </change>
       </input>
      </fieldset>
      <row>
       <panel>
        <table>
         <title>Test-Result=$test-result$ ------ field=$field100$ </title>
          <search>
           <query>index=**</query>
           <earliest>0</earliest>
          </search>
         </table>
        </panel>
       </row>
    </form>

jeffland
SplunkTrust
SplunkTrust

Yeah, this feature came new with 6.3... nice find!

0 Karma

harishalipaka
Motivator

Hi All,
I am also looking for this issue.
am using like this what did you gave answers.

ALL


True



True


But is is not working for me am using splunk 6.6.1

It is working this code

ALL


True



True


It is ok but what my problem is ...
This code working good in desktop but it is not working in mobiles.
please help for this .
my question link; link text

Thanks
Harish
0 Karma

harishalipaka
Motivator
0 Karma

jeffland
SplunkTrust
SplunkTrust

Update: this is possible in 6.3+, see accepted answer above.

The reference doesn't say anything about wildcards, it only specifies * as a setting to apply this to every input value element, i.e. that this condition is independent of the value that the input has changed to (which would be the same as not having the condition at all). Therefore, it's no wonder that your code above always responds with someOtherUrl, as the second condition is always met.

I doubt the conditions are tried in the order they appear and stop when a match has been found, which would be a case-like behavior; I would expect all conditions to be tried and if the result a condition produces overlaps with that of a previously tried condition (as with the token "testUrl" in your case), I would expect it to overwrite the previously set value. But this is only speculation at the moment, I will see and try if I can figure that out.

In the meantime, have you tried using two exclusive, more excplicit values, something like

<change>
    <condition value="*smokeA*">
        <set token="testUrl">http://someUrl</set>
    </condition>
    <condition value="*smokeB*">
        <set token="testUrl">http://someOtherUrl</set>
    </condition>
</change>

I'm not sure about this, but if those values take wildcards, this might work because they only ever apply one at a time.

In any case, you should be able to do what you want with Javascript: listen to a change event on the input, check the value for your condition, and set the token accordingly.


UPDATE: In fact, conditions do behave case-like. If you let them check something explicitly, i.e. full text match, only the first condition's action is applied, so you can use that condition with value=* as the last condtion, after all others did not match, kind of like the 1=1 condition in a case statement.

0 Karma

bruceclarke
Contributor

From what I can tell, the conditional isn't respecting wildcards. My guess is that the value="*" option is a special case that Splunk handles. It's not indicative of it accepting wildcards.

Unfortunately this means I'll have to edit the javascript or find a different workaround. But let me know if anyone else finds a good way to do this!

0 Karma

jeffland
SplunkTrust
SplunkTrust

Yes, it would seem that unfortunately, wildcards are not supported in these value condition checks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...