Dashboards & Visualizations

How do I perform a drilldown by checking multiple tokens in the same condition?

Builder

Hello,

I have three tokens: token_1, token_2, and token_3. I'm trying to set the value of token_3 based on the values of token_1 and token_2, but I cannot for the life of me figure out the correct syntax in the drilldown tag. The conditions for setting token_3 are the following:

  1. token_1 must not be null
  2. token_2 must have value "OK"

The following XML does not create errors, but doesn't work either:

    <condition match="NOT isnull(token_1) &amp;&amp; token_2=&quot;OK&quot;">
        <set token="token_3">*</set>
    </condition>
</drilldown>

I've tried using $$ around the token names and replacing = with ==, but nothing works.

A push in the right direction would be greatly appreciated.

Thank you and best regards,

Andrew

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Can you try ?

<drilldown>
        <condition match="isnotnull($token_1$) AND $token_2$=&quot;OK&quot;">
          <set token="token_3">*</set>
      </condition>
  </drilldown>

View solution in original post

SplunkTrust
SplunkTrust

Can you try ?

<drilldown>
        <condition match="isnotnull($token_1$) AND $token_2$=&quot;OK&quot;">
          <set token="token_3">*</set>
      </condition>
  </drilldown>

View solution in original post

Builder

@mayurr98 This works! I tried your original piece of code that didn't work, then realized that you had updated your comment with working code! I was very close, just a question of the right combination. Good to know! Thanks, very much appreciated.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!