How to set multiple tokens using "condition match"?

[javierjmg]

To set tokens, I have several "condition match" in a search but, if more than one condition is matched, only the first one seems to work.
To simplify my use case:

        <search>
          <query>index=_internal | stats count by host | table host, count</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="len($result.host$)!=0">
              <set token="showtab1">t1</set>
            </condition>
            <condition match="len($result.count$)!=0">
              <set token="showtab2">t2</set>
            </condition>
          </done>
        </search>

What I expect is that both tokens will be set (both result.host and result.count exist and have a value).
However, only "showtab1" is set.

To my surprise, if I swap the conditions order:

        [...]
          <done>
            <condition match="len($result.count$)!=0">
              <set token="showtab2">t2</set>
            </condition>
            <condition match="len($result.host$)!=0">
              <set token="showtab1">t1</set>
            </condition>
          </done>
        [...]

Now, "showtab2" is set (and "showtab1" is unset...)

What I'm missing here?

[woodcock]

I have a better answer than multiplexing logic: multiple <change> sections, like this:

<change>
   <condition match="len($result.host$)!=0">
      <set token="showtab1">t1</set>
   </condition>
   <condition>
      <unset token="showtab1"></unset>
   </condition>
</change>
<change>
   <condition match="len($result.count$)!=0">
      <set token="showtab2">t2</set>
   </condition>
   <condition>
      <unset token="showtab2"></unset>
   </condition>
</change>

In the case of 2x2 like this either solution is about the same. However when you scale to a much larger matrix of fields and values, this solution is waaaaaaaaaaaaaaaaay better.

[akew]

This answer solves an issue I am having.  I like the way this is structured. 

@woodcock, if I'm reading this correctly (and a test verifies this), as soon as a condition fires, all other conditions are ignored.  There is no nesting her, but an elegant trigger condition, or an "else" condition that fires to do other business logic (show/hide here).

Very nice.

[waleeper]

According to the form documentation you can only have one change block. https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/PanelreferenceforSimplifiedXML#change_.28form...

[woodcock]

Please post the text, too. I read the link and other than the use of the definite article "the", which only implies a constraint, I do not see a limitation listed. In any case, it does work and I often use it.

[rjthibod · Accepted solution]

The issue is only one condition is ever executed. They are like if, else-if, else structures.

So you need to combine the two outcomes in one condition and then separate them out.

    <condition match="len($result.host$)!=0 AND len($result.count$)!=0">
        <set token="showtab1">t1</set>
        <set token="showtab2">t2</set>
    <condition match="len($result.host$)!=0">
        <set token="showtab1">t1</set>
    </condition>
    <condition match="len($result.count$)!=0">
        <set token="showtab2">t2</set>
    </condition>

[DavidCH12345]

It doesn't allow me to open two conditions and only close one. (on line 6.)
How did you get it to run when the open/close tags are not complete?

[javierjmg]

It works. Many thanks.

[sayanidasgupta]

I am facing same kind of problem, please correct my code where I am doing wrong -

  <label>Select Category</label>
  <choice value="capability">CAPABILITY</choice>
  <choice value="lob">LOB</choice>
  <choice value="service">SERVICE</choice>
  <choice value="client">CLIENT</choice>
  <change>


  <set token="show_capability">true</set>
  </condition>
  <condition>
  <unset token="show_capability"></unset>
  </condition>

  <condition value="lob">
  <set token="show_lobName">true</set>
  </condition>
  <condition>
  <unset token="show_lobName"></unset>
  </condition>
  </change>





  <label>Select capability name:</label>
  <search>
    <query>|inputlookup lookup_STAACapability.csv | dedup Capability | eval Capability1=upper(Capability)| sort Capability1  |  table Capability</query>
  </search>
  <fieldForLabel>Capability</fieldForLabel>
  <fieldForValue>Capability</fieldForValue>
</input>


  <label>Select LOB Name:</label>
  <search>
    <query>|inputlookup lookup_STAALob.csv| dedup LOBName| eval LOBName1=upper(ClientName)|sort LOBName1 | table LOBName</query>
  </search>
  <fieldForLabel>LOBName</fieldForLabel>
  <fieldForValue>LOBName</fieldForValue>
</input>
 </fieldset>