Dashboards & Visualizations
Highlighted

How to match two conditions?

Explorer

Hello!!

So what I want to do is to match two conditions:

I have a condition named "15 minuttes" and other one named "hier". What I want to do is to match both of them so when it "15 minuttes" and "Hier" I load "AnalysefineduTchatHier30".

        <condition label="15 minuttes">
          <set token="earliest_token">$value$</set>
          <set token="show_Data_Labels_token">none</set>
          <set token="loadjob_token_analyse_fine">Analyse_fine_du_Tchat_Hier30</set>
        </condition>

        <condition label="Hier">
          <set token="earliest_token">$value$</set>
          <set token="show_Data_Labels_token">none</set>
          <set token="loadjob_token_analyse_fine">Analyse_fine_du_Tchat_Hier30</set>
        </condition>

Thank you

0 Karma
Highlighted

Re: How to match two conditions?

Contributor

Assuming this is one single log entry

|eval token=if(condition{0}{@label}=="15 minuttes" AND condition{1}{@label}=="Hier", condition{1}.set{2},0)

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.