Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to use condition match to show a column when c...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to use condition match to show a column when conditions match and omit the column when it doesn't in type dropdown ?
Hi All,
I am new to Splunk so I am not sure if I am doing this right.
For one of the use cases, I am trying to use a condition match in the type dropdown to make a column visible when the condition match and omit the column when it doesn't.
Below is the code I am using where I am creating a new token called cache_type_token and setting the value from the input token cache_type.
I am unable to understand if there's some issue with the token being set or the match condition.
<input type="dropdown" token="cache_type" searchWhenChanged="true">
<label>Choose which type of cache to view</label>
<choice value="*UTable-*">Utilisation Table</choice>
<choice value="ContextualLineCache*">Contextual Line Cache</choice>
<choice value="GlobalRuleCache*">Global Rule Cache</choice>
<choice value="RTLIM*">RTLIM</choice>
<choice value="BATCH*">BATCH</choice>
<choice value="COB*">COB</choice>
<choice value="EOM*">EOM</choice>
<choice value="*">ALL</choice>
<default>Utilisation Table</default>
<change>
<set token='cache_type_token'>$cache_type$</set>
<condition match=" $cache_type_token$ == "ContextualLineCache*" ">
<set token="cache_type_token">0</set>
</condition>
<condition match=" $cache_type_token$ != "ContextualLineCache*" ">
<set token="cache_type_token">cacheExpired</set>
</condition>
</change>
</input>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you should use "eval token".
Here is a simplified example of your case:
<dashboard>
<label>Test</label>
<init>
<unset token="cache_type"></unset>
<unset token="cache_type_token"></unset>
</init>
<fieldset>
<input type="dropdown" token="cache_type" searchWhenChanged="true">
<change>
<condition match=" $cache_type$ == "ContextualLineCache*" ">
<eval token="cache_type_token">0</eval>
</condition>
<condition>
<eval token="cache_type_token">$cache_type$</eval>
</condition>
</change>
<label>Choose which type of cache to view</label>
<choice value="*UTable-*">Utilisation Table</choice>
<choice value="ContextualLineCache*">Contextual Line Cache</choice>
<choice value="GlobalRuleCache*">Global Rule Cache</choice>
<choice value="RTLIM*">RTLIM</choice>
<choice value="BATCH*">BATCH</choice>
<choice value="COB*">COB</choice>
<choice value="EOM*">EOM</choice>
<choice value="*">ALL</choice>
<default>Utilisation Table</default>
</input>
</fieldset>
<row>
<html>
cache_type: $cache_type$ cache_type_token: $cache_type_token$
</html>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rroversThanks for your response. Actually, I was able to figure out what went wrong.
I was setting the token wrong outside of the condition tags.
<change>
<condition match=" $cache_type$ == "ContextualLineCache*" ">
<eval token="cache_type_token">0</eval>
</condition>
<condition>
<eval token="cache_type_token">cacheExpired</eval>
</condition>
</change>
I even tried your code and realised that using eval doesn't set the token rather makes it undefined. Also, since I was making changes in the panel init tags didn't work. Thanks again.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
