Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How to use condition match to show a column wh...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to use condition match to show a column when conditions match and omit the column when it doesn't in type dropdown ?
Hi All,
I am new to Splunk so I am not sure if I am doing this right.
For one of the use cases, I am trying to use a condition match in the type dropdown to make a column visible when the condition match and omit the column when it doesn't.
Below is the code I am using where I am creating a new token called cache_type_token and setting the value from the input token cache_type.
I am unable to understand if there's some issue with the token being set or the match condition.
<input type="dropdown" token="cache_type" searchWhenChanged="true">
<label>Choose which type of cache to view</label>
<choice value="*UTable-*">Utilisation Table</choice>
<choice value="ContextualLineCache*">Contextual Line Cache</choice>
<choice value="GlobalRuleCache*">Global Rule Cache</choice>
<choice value="RTLIM*">RTLIM</choice>
<choice value="BATCH*">BATCH</choice>
<choice value="COB*">COB</choice>
<choice value="EOM*">EOM</choice>
<choice value="*">ALL</choice>
<default>Utilisation Table</default>
<change>
<set token='cache_type_token'>$cache_type$</set>
<condition match=" $cache_type_token$ == "ContextualLineCache*" ">
<set token="cache_type_token">0</set>
</condition>
<condition match=" $cache_type_token$ != "ContextualLineCache*" ">
<set token="cache_type_token">cacheExpired</set>
</condition>
</change>
</input>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you should use "eval token".
Here is a simplified example of your case:
<dashboard>
<label>Test</label>
<init>
<unset token="cache_type"></unset>
<unset token="cache_type_token"></unset>
</init>
<fieldset>
<input type="dropdown" token="cache_type" searchWhenChanged="true">
<change>
<condition match=" $cache_type$ == "ContextualLineCache*" ">
<eval token="cache_type_token">0</eval>
</condition>
<condition>
<eval token="cache_type_token">$cache_type$</eval>
</condition>
</change>
<label>Choose which type of cache to view</label>
<choice value="*UTable-*">Utilisation Table</choice>
<choice value="ContextualLineCache*">Contextual Line Cache</choice>
<choice value="GlobalRuleCache*">Global Rule Cache</choice>
<choice value="RTLIM*">RTLIM</choice>
<choice value="BATCH*">BATCH</choice>
<choice value="COB*">COB</choice>
<choice value="EOM*">EOM</choice>
<choice value="*">ALL</choice>
<default>Utilisation Table</default>
</input>
</fieldset>
<row>
<html>
cache_type: $cache_type$ cache_type_token: $cache_type_token$
</html>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rroversThanks for your response. Actually, I was able to figure out what went wrong.
I was setting the token wrong outside of the condition tags.
<change>
<condition match=" $cache_type$ == "ContextualLineCache*" ">
<eval token="cache_type_token">0</eval>
</condition>
<condition>
<eval token="cache_type_token">cacheExpired</eval>
</condition>
</change>
I even tried your code and realised that using eval doesn't set the token rather makes it undefined. Also, since I was making changes in the panel init tags didn't work. Thanks again.
Accelerating Observability as Code with the Splunk AI Assistant
Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...
Congratulations to the 2025-2026 SplunkTrust!
