Hello,
I'm working on showing a panel if the $env:user$ is a match based on a search.
The search that I'm using works for this use case:
| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id
This retrieves the appropriate ID (otherwise, I would just use the $evn:user$ for conditional visibility, but this never works).
With the query result, I set a token envid to $result.id$
I then do a condition match where $envid$==uu_33 (uu_33 represents the user ID required to display a panel).
The result of the query is always correct with "uu_33", which matches the condition I have written.
I have tried following the splunk guides, and I have tried the following condition matches:
Nothing makes the panel show.
Here is my XML. Any help would be appreciated.
<dashboard>
<label>testenvid</label>
<row>
<panel>
<html>
<b>hi. your current id is $env:user$. The current result is $envid$ is set to be equal to $result.id$.</b>
</html>
</panel>
<panel depends="$showpanel$">
<table>
<search>
<finalized>
<set token="envid">$result.id$</set>
</finalized>
<done>
<condition match="'$envid$'=="uu_33"">
<set token="showpanel">TRUE</set>
</condition>
</done>
<query>| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id</query>
<earliest>-60m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</dashboard>
Try this
<panel depends="$showpanel$">
<table>
<title>$showpanel$</title>
<search>
<done>
<condition>
<eval token="showpanel">if($result.user$="uu_33","TRUE",null())</eval>
</condition>
</done>
<query>| makeresults
| eval user=$env:user|s$</query>
<earliest>-60m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
Try something like this:
<panel depends="$showpanel$">
<table>
<search>
<done>
<condition>
<eval token="showpanel">if($env:user$="uu_33","TRUE",null())</eval>
</condition>
</done>
<query>| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id</query>
<earliest>-60m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
Hmm, no luck with that either. showpanel is actually setting to null instead of true, which seems like evn:user isn't passing, but the simple html debug shows the id as being fine.
Try this
<panel depends="$showpanel$">
<table>
<title>$showpanel$</title>
<search>
<done>
<condition>
<eval token="showpanel">if($result.user$="uu_33","TRUE",null())</eval>
</condition>
</done>
<query>| makeresults
| eval user=$env:user|s$</query>
<earliest>-60m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
Perfect! That worked. Did a quick check with both invalid and valid IDs and the expected result occurred.
Thank you!