Dashboards & Visualizations

How could I check multiple condition(state) at <input> token?

Questioner
Path Finder

I want to combine these two <condition> into one.

<input>
.....
<change>
<condition value = "BT">
<unset token="show_wifi_connect_type"></unset>
</condition>
<condition value="UART">
<unset token="show_wifi_connect_type"></unset>
</condition>
</change>
...
</input>

I tried combine these two status using "match", but it doesn't work.
How could I solve this problem?

Labels (1)
Tags (2)
0 Karma
1 Solution

dtburrows3
Builder

I believe this should do it.

<input>
.....
  <change>
    <condition match="'value'==&quot;BT&quot; OR 'value'==&quot;UART&quot;">
        <unset token="show_wifi_connect_type"></unset>
    </condition>
   </change>
...
</input>

 
You can see on the screenshots it worked as expected when testing locally.

dtburrows3_0-1703773137637.png

dtburrows3_1-1703773155945.png

dtburrows3_2-1703773171653.png

 

View solution in original post

Questioner
Path Finder

@dtburrows3  Thank you for your support!

It work!

0 Karma

dtburrows3
Builder

I believe this should do it.

<input>
.....
  <change>
    <condition match="'value'==&quot;BT&quot; OR 'value'==&quot;UART&quot;">
        <unset token="show_wifi_connect_type"></unset>
    </condition>
   </change>
...
</input>

 
You can see on the screenshots it worked as expected when testing locally.

dtburrows3_0-1703773137637.png

dtburrows3_1-1703773155945.png

dtburrows3_2-1703773171653.png

 

Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...