Dashboards & Visualizations

How to set token by comparing values of other token

Path Finder

I have a dashboard which sets couple of tokens and passes the token to next dashboard on user click.
I want to compare the value of one of the token (say token_master) with specific string and if it's true it should set another token. snippet of my XML is given below:

<init>
    <condition match="$master_token$=='Data Entry'">
      <set token="data_entry">True</set>
      <unset token="attachment"></unset>
      <unset token="click_only"></unset>
    </condition>

    <condition match="$master_token$=='Click Only'">
      <set token="click_only">True</set>
      <unset token="data_entry"></unset>
      <unset token="attachment"></unset>

    </condition>

    <condition match="$master_token$=='Attachment'">
      <set token="attachment">True</set>
      <unset token="click_only"></unset>
      <unset token="data_entry"></unset>
    </condition>

      </init>

However, somehow, it's not setting the other 3 tokens that i want. Not sure if the issue is with the value comparison, or at the token setting.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@qbolbk59 while your question does not describe where/when is the master_token is set, as far as master_token is set the following independent search would be able to set the remaining tokens as needed.

In the following run anywhere example I am using init section to set the master_token but in actual code it can be anywhere either in the same dashboard or coming from a different dashboard, as the independent search to set the remaining tokens will run only after the master_token is set. Please try out and confirm!

<dashboard>
  <label>Set token on load</label>
  <init>
    <set token="master_token">Data Entry</set>
  </init>
  <search>
    <query>
      | makeresults
      | fields - _time
      | eval master_token="$master_token$"
    </query>
    <progress>
       <condition match="$master_token$==&quot;Data Entry&quot;">
         <set token="data_entry">True</set>
         <unset token="attachment"></unset>
         <unset token="click_only"></unset>
       </condition>
       <condition match="$master_token$==&quot;Click Only&quot;">
         <set token="click_only">True</set>
         <unset token="data_entry"></unset>
         <unset token="attachment"></unset>
       </condition>
       <condition match="$master_token$==&quot;Attachment&quot;">
         <set token="attachment">True</set>
         <unset token="click_only"></unset>
         <unset token="data_entry"></unset>
       </condition>
     </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>master_token: $master_token$</div>
        <div>data_entry: $data_entry$</div>
        <div>click_only: $click_only$</div>
        <div>data_entry: $attachment$</div>
      </html>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

SplunkTrust
SplunkTrust

@qbolbk59 while your question does not describe where/when is the master_token is set, as far as master_token is set the following independent search would be able to set the remaining tokens as needed.

In the following run anywhere example I am using init section to set the master_token but in actual code it can be anywhere either in the same dashboard or coming from a different dashboard, as the independent search to set the remaining tokens will run only after the master_token is set. Please try out and confirm!

<dashboard>
  <label>Set token on load</label>
  <init>
    <set token="master_token">Data Entry</set>
  </init>
  <search>
    <query>
      | makeresults
      | fields - _time
      | eval master_token="$master_token$"
    </query>
    <progress>
       <condition match="$master_token$==&quot;Data Entry&quot;">
         <set token="data_entry">True</set>
         <unset token="attachment"></unset>
         <unset token="click_only"></unset>
       </condition>
       <condition match="$master_token$==&quot;Click Only&quot;">
         <set token="click_only">True</set>
         <unset token="data_entry"></unset>
         <unset token="attachment"></unset>
       </condition>
       <condition match="$master_token$==&quot;Attachment&quot;">
         <set token="attachment">True</set>
         <unset token="click_only"></unset>
         <unset token="data_entry"></unset>
       </condition>
     </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>master_token: $master_token$</div>
        <div>data_entry: $data_entry$</div>
        <div>click_only: $click_only$</div>
        <div>data_entry: $attachment$</div>
      </html>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Path Finder

Hi @niketnilay ,

The mastertoken is set on a different dashboard. The token is passed to the current dashboard when clicked on a table row. I checked and the mastertoken is indeed being sent successfully on the current dashboard. So that's not a problem now.

The situation is that the master_token may have three values i.e., "Data Entry", "attachment" and "Click Only". Now on my current dashboard, i want to load some specific panels based on the value of the master token. And hence i want to compare the values and based on the value of master token, i am setting new tokens.

These token will then be used to load specific panels, if set. Hope i am clear with my requirement now. 🙂

0 Karma

Champion

hi @qbolbk59
How are you passing the master token in your first dashboard, something like this?

<set token="master_token">$click.value2$</set>

If your master token gets captured in the second dashboard you can use @niketnilay or my solution.

0 Karma

SplunkTrust
SplunkTrust

@qbolbk59 since you are passing token from other dashboard to this one, either one of the solution should work. Having said that, my answer would work in either case. The moment master_token gets value or its value changes, the independent search will fire and hence required token would be set. You need to incorporate the independent search (i.e. search without a view only used to set required token/s through search event handler) as per your needs in your existing dashboard.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

Hi @niketnilay ,

the solution you proposed worked for me. Although the search tag is not doing anything for me. So i am just using it to make the progress tag valid. But anyways, it works for me now.
Thanks a lot !
Cheers !!!

SplunkTrust
SplunkTrust

Yes the independent search is used to handle the value and set subsequent token to be used in actual search. It is a dummy search but required. Glad you found the solution working.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Champion

hi @qbolbk59

where are you setting the master_token value in the first place, probably just above the conditions under init?
if you remove your conditions the token will get set.
Now, why dont you have a dummy hidden search AFTER your init token is set, and play around with the token setttings for your 3 other tokens there?
something like this

 <form>
       <label>wwww</label>
      <init>

         <set token="app_name">true</set>


      </init>
      <row>
      <panel>
        <table>
      <search>
              <query>|makeresults | eval x="$app_name$"|table x</query>
              <earliest>0</earliest>
              <latest>now</latest>
            </search>
            </table>
        </panel>
        </row>

here i am setting the token appname on init and using it just after in a panel, i can make that panel hidden always and set other values in the section of the panel. Since the init sets the token appname only once, the processing based on that token in the second panel will remain constant.
I must confess I am unable to understand your functional requirements exactly though and looking at this from a purely technical angle wrt to the init settings

Path Finder

Hi @Sukisen1981 ,

I agree with your solution but unfortunately it's not getting me what i want. Please check the comment in the below response from @niketnilay . I have listed the requirement there.

0 Karma

Contributor

Can you try modifying the init tag by change

<change>
     <condition match="$master_token$=='Data Entry'">
       <set token="data_entry">True</set>
       <unset token="attachment"></unset>
       <unset token="click_only"></unset>
     </condition>

     <condition match="$master_token$=='Click Only'">
       <set token="click_only">True</set>
       <unset token="data_entry"></unset>
       <unset token="attachment"></unset>

     </condition>

     <condition match="$master_token$=='Attachment'">
       <set token="attachment">True</set>
       <unset token="click_only"></unset>
       <unset token="data_entry"></unset>
     </condition>

 </change>

init will initialize the token for the first time and change will change the tokens value everytime you have a change on your master_token.

0 Karma

Path Finder

HI @KailA ,

The change tag would work if this token setting section is under the search tag. But i am setting these tokens in the tag, i mean outside all search tags. The reason being, as soon as the page loads, i want the tokens to be set as the tokens will then be used to load panels (using "depends").

0 Karma

SplunkTrust
SplunkTrust

@qbolbk59 this is the confusion, if you are trying setting tokens in the init section, where is the $master_token$ value coming from? Is it coming from another dashboard? If you do not design this properly, you will end up with a token that never resolves when the dashboard load.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma