Solved: Re: How to set token from search and then conditio...

mjon395 · ‎06-10-2022

Hello,

I'm working on showing a panel if the $env:user$ is a match based on a search.

The search that I'm using works for this use case:

| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id

This retrieves the appropriate ID (otherwise, I would just use the $evn:user$ for conditional visibility, but this never works).

With the query result, I set a token envid to $result.id$

I then do a condition match where $envid$==uu_33 (uu_33 represents the user ID required to display a panel).

The result of the query is always correct with "uu_33", which matches the condition I have written.

I have tried following the splunk guides, and I have tried the following condition matches:

<condition match="'$envid$'=="uu_33""> (current)
<condition match="$envid$=="uu_33"">
<condition match="'$envid$'==uu_33">
<condition match="$envid$==uu_33">

Nothing makes the panel show.

Here is my XML. Any help would be appreciated.

<dashboard>
  <label>testenvid</label>
  <row>
    <panel>
      <html>
        <b>hi.  your current id is $env:user$.  The current result is $envid$ is set to be equal to $result.id$.</b>
      </html>
    </panel>
    <panel depends="$showpanel$">
      <table>
        <search>
          <finalized>
            <set token="envid">$result.id$</set>
          </finalized>
          <done>
            <condition match="'$envid$'==&quot;uu_33&quot;">
              <set token="showpanel">TRUE</set>
            </condition>
          </done>
          <query>| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

ITWhisperer · ‎06-11-2022

Try this

    <panel depends="$showpanel$">
      <table>
        <title>$showpanel$</title>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($result.user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| makeresults
| eval user=$env:user|s$</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>

View solution in original post

ITWhisperer · ‎06-10-2022

Try something like this:

    <panel depends="$showpanel$">
      <table>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($env:user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| rest /services/authentication/current-context splunk_server=local
| fields username
| rename username AS id</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>

mjon395 · ‎06-10-2022

Hmm, no luck with that either. showpanel is actually setting to null instead of true, which seems like evn:user isn't passing, but the simple html debug shows the id as being fine.

ITWhisperer · ‎06-11-2022

Try this

    <panel depends="$showpanel$">
      <table>
        <title>$showpanel$</title>
        <search>
          <done>
            <condition>
              <eval token="showpanel">if($result.user$="uu_33","TRUE",null())</eval>
            </condition>
          </done>
          <query>| makeresults
| eval user=$env:user|s$</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>

mjon395 · ‎06-13-2022

Perfect! That worked. Did a quick check with both invalid and valid IDs and the expected result occurred.

Thank you!

How to set token from search and then conditionally show a panel if token condition matches?

panel

simple XML

token

Can’t make it to .conf25? Join us online!

Calling All Security Pros: Ready to Race Through Boston?

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Customer success is front and center at .conf25

Are you a member of the Splunk Community?