How to take a token value and use it in a conditional statement within a panel?

[SLoBello]

What I have set up:

$panel_2$ is a token with a Boolean value inside the main panel.
$panel_3$ is a token with a Boolean value inside panel 2
(I also have other tokens in each panel that set values to the clicked field, such as $_sourcetype$)

Main Panel has data. User clicks the sourcetype (the row/column of interest) to access more details.
$panel_2$ has been set to true and that panel is visible. User wants more details and clicks a field of interest.
$panel_3$ has been set to true and that panel is visible.

These work fine without issues when the sourcetypes have similar fields for the query
(i.e. WinEventLog:Security & WinEventLog:Application work fine obviously)

THE ISSUE: I want to change between two or three queries depending on the sourcetype selected.
(checking whether it doesn't produce results would be a plus)

"syslog" for example does not work with the query in panel 2.

I want to check the token $_sourcetype$ to "syslog" and use a query that would provide me results.

panel 2
...bla bla...
-----search
--------if ($_sourcetype$ == syslog)
--------------query>use this query
--------else ()
--------------query>use this one
-----/search
...bla bla...
/panel

I know this can be done using condition match and switching between another panel. But I want to keep this within the same panel

[tiagofbmm · Accepted solution]

If you want to maintain that so much in the same panel, you can create a tokens that contains the one search query. In case your condition matches, you change that token to the other search you want to be run

[SLoBello]

I didn't even think of that. Awesome, thank you!

[rey123]

@tiagofbmm, could you please share the source xml of the working solution, if possible? That way, those of trying to achieve the same thing could understand the syntax and 'how to', better. Thank you!