How do I perform a drilldown by checking multiple tokens in the same condition?

[andrewtrobec]

Hello,

I have three tokens: token_1, token_2, and token_3. I'm trying to set the value of token_3 based on the values of token_1 and token_2, but I cannot for the life of me figure out the correct syntax in the drilldown tag. The conditions for setting token_3 are the following:

1. token_1 must not be null
2. token_2 must have value "OK"

The following XML does not create errors, but doesn't work either:

    <condition match="NOT isnull(token_1) &amp;&amp; token_2=&quot;OK&quot;">
        <set token="token_3">*</set>
    </condition>
</drilldown>

I've tried using $$ around the token names and replacing = with ==, but nothing works.

A push in the right direction would be greatly appreciated.

Thank you and best regards,

Andrew

[mayurr98 · Accepted solution]

Can you try ?

<drilldown>
        <condition match="isnotnull($token_1$) AND $token_2$=&quot;OK&quot;">
          <set token="token_3">*</set>
      </condition>
  </drilldown>

[kd172906]

How would you combine "match" and "label" into a single <condition>?  I've tried the following but keep getting syntax warnings in my Splunk dashboard editor:

<condition label="Test" , match="$myToken$ = 123">
<condition label="Test" and match="$myToken$ = 123">
<condition label="Test" &amp; match="$myToken$ = 123">

[andrewtrobec]

@mayurr98 This works! I tried your original piece of code that didn't work, then realized that you had updated your comment with working code! I was very close, just a question of the right combination. Good to know! Thanks, very much appreciated.