Dashboards & Visualizations

Dropdown Condition - Match regex value on change

Contributor

Hey,

I have a dashboard for which I want to set a value based on whether a string matches a smoke test. This is the XML I have:

<change>
    <condition value="*smoke*">
        <set token="testUrl">http://someUrl</set>
    </condition>
    <condition value="*">
        <set token="testUrl">http://someOtherUrl</set>
    </condition>
</change>

The change condition doesn't seem to respect asterisk wildcards though. It's always directing to http://someOtherUrl. Is there a way to get this to work?

0 Karma
1 Solution

Builder

In 6.3 I put the following xml together that performs a test like you describe:

    <form>
     <label>Test_smoke</label>
      <fieldset>
       <input type="text" token="field100">
        <change>
         <condition match="match(value, &quot;smoke&quot;)">
          <set token="test-result">Is_smoke</set>
         </condition>
         <condition>
          <set token="test-result">Is_NOT_smoke</set>
         </condition>
        </change>
       </input>
      </fieldset>
      <row>
       <panel>
        <table>
         <title>Test-Result=$test-result$ ------ field=$field100$ </title>
          <search>
           <query>index=**</query>
           <earliest>0</earliest>
          </search>
         </table>
        </panel>
       </row>
    </form>

View solution in original post

SplunkTrust
SplunkTrust

Hi

Can you please try this?

<change>
         <condition match="like($value$,&quot;%smoke%&quot;)">
             <set token="testUrl">http://someUrl</set>
         </condition>
         <condition value="*">
             <set token="testUrl">http://someOtherUrl</set>
         </condition>
     </change>

Here I have used like() in match.

eg,

like($value$,&quot;%smoke%&quot;)

Happy Splunking

0 Karma

Engager

this worked for me

0 Karma

Builder

In 6.3 I put the following xml together that performs a test like you describe:

    <form>
     <label>Test_smoke</label>
      <fieldset>
       <input type="text" token="field100">
        <change>
         <condition match="match(value, &quot;smoke&quot;)">
          <set token="test-result">Is_smoke</set>
         </condition>
         <condition>
          <set token="test-result">Is_NOT_smoke</set>
         </condition>
        </change>
       </input>
      </fieldset>
      <row>
       <panel>
        <table>
         <title>Test-Result=$test-result$ ------ field=$field100$ </title>
          <search>
           <query>index=**</query>
           <earliest>0</earliest>
          </search>
         </table>
        </panel>
       </row>
    </form>

View solution in original post

Champion

Yeah, this feature came new with 6.3... nice find!

0 Karma

Hi All,
I am also looking for this issue.
am using like this what did you gave answers.

ALL


True



True


But is is not working for me am using splunk 6.6.1

It is working this code

ALL


True



True


It is ok but what my problem is ...
This code working good in desktop but it is not working in mobiles.
please help for this .
my question link; link text

0 Karma

0 Karma

Champion

Update: this is possible in 6.3+, see accepted answer above.

The reference doesn't say anything about wildcards, it only specifies * as a setting to apply this to every input value element, i.e. that this condition is independent of the value that the input has changed to (which would be the same as not having the condition at all). Therefore, it's no wonder that your code above always responds with someOtherUrl, as the second condition is always met.

I doubt the conditions are tried in the order they appear and stop when a match has been found, which would be a case-like behavior; I would expect all conditions to be tried and if the result a condition produces overlaps with that of a previously tried condition (as with the token "testUrl" in your case), I would expect it to overwrite the previously set value. But this is only speculation at the moment, I will see and try if I can figure that out.

In the meantime, have you tried using two exclusive, more excplicit values, something like

<change>
    <condition value="*smokeA*">
        <set token="testUrl">http://someUrl</set>
    </condition>
    <condition value="*smokeB*">
        <set token="testUrl">http://someOtherUrl</set>
    </condition>
</change>

I'm not sure about this, but if those values take wildcards, this might work because they only ever apply one at a time.

In any case, you should be able to do what you want with Javascript: listen to a change event on the input, check the value for your condition, and set the token accordingly.


UPDATE: In fact, conditions do behave case-like. If you let them check something explicitly, i.e. full text match, only the first condition's action is applied, so you can use that condition with value=* as the last condtion, after all others did not match, kind of like the 1=1 condition in a case statement.

0 Karma

Contributor

From what I can tell, the conditional isn't respecting wildcards. My guess is that the value="*" option is a special case that Splunk handles. It's not indicative of it accepting wildcards.

Unfortunately this means I'll have to edit the javascript or find a different workaround. But let me know if anyone else finds a good way to do this!

0 Karma

Champion

Yes, it would seem that unfortunately, wildcards are not supported in these value condition checks.

0 Karma