Dashboards & Visualizations

How to Drilldown Conditional match with like function using a Token?

Manny
Observer

Hi,

I have tried many different ways to get a match with a like using a token to a string to set and unset a different set of tokens but I just cant seem to be able to meet the condition eventough I know I am selecting a click.value (which gets saved into a token) and that token value contains the string that I am using in the like command.

What am I doing wrong? please help.

<chart>
<search>
<query>index=car | dedup run_id | top limit=100 sourcetype | search sourcetype=$form.car_type$</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">column</option>
<drilldown>
<condition>
<set token="show_panel">true</set>
<set token="form.car_type">$click.value$</set>
<set token="clickedfixture">$click.value$</set>
</condition>
<condition match="like($form.car_type$,&quot;%ford%&quot;)">
<set token="carford">true</set>
<unset token="data_entry"></unset>
<unset token="attachment"></unset>
</condition>
</drilldown>
</chart>

Labels (2)
Tags (1)
0 Karma

Manny
Observer

Hi @kamlesh_vaghela it did not work. I still dont get the $carford$ set.

thx

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Manny 

Generally we kept default condition at last. Can you please try this?

<condition match="like($form.car_type$,&quot;%ford%&quot;)">
<set token="carford">true</set>
<unset token="data_entry"></unset>
<unset token="attachment"></unset>
</condition>
<condition>
<set token="show_panel">true</set>
<set token="form.car_type">$click.value$</set>
<set token="clickedfixture">$click.value$</set>
</condition>

 

KV

0 Karma

Manny
Observer

@kamlesh_vaghela  note that $form.car_type$ has a value that changes depending on what the user clicks (a drilldown) but one of the columns that can be clicked is "car_type_ford" when that gets selected I would expect that the match with the like would be satified and therefore the $carford$ would be set.

I can see that $form.car_type$ does change to "car_type_ford" but the still the token $carford$ does not get set.

thx

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Manny 

Is it possible to share XML with sample data (NO original values) here ?

KV

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...