Dashboards & Visualizations

How to use condition match to show a column when conditions match and omit the column when it doesn't in type dropdown ?

_pravin
Contributor

Hi All,

I am new to Splunk so I am not sure if I am doing this right.

For one of the use cases, I am trying to use a condition match in the type dropdown to make a column visible when the condition match and omit the column when it doesn't.

Below is the code I am using where I am creating a new token called cache_type_token and setting the value from the input token cache_type.

I am unable to understand if there's some issue with the token being set or the match condition.

 

<input type="dropdown" token="cache_type" searchWhenChanged="true">
<label>Choose which type of cache to view</label>
<choice value="*UTable-*">Utilisation Table</choice>
<choice value="ContextualLineCache*">Contextual Line Cache</choice>
<choice value="GlobalRuleCache*">Global Rule Cache</choice>
<choice value="RTLIM*">RTLIM</choice>
<choice value="BATCH*">BATCH</choice>
<choice value="COB*">COB</choice>
<choice value="EOM*">EOM</choice>
<choice value="*">ALL</choice>
<default>Utilisation Table</default>


<change>
<set token='cache_type_token'>$cache_type$</set>

<condition match=" $cache_type_token$ == &quot;ContextualLineCache*&quot; ">
<set token="cache_type_token">0</set>
</condition>

<condition match=" $cache_type_token$ != &quot;ContextualLineCache*&quot; ">
<set token="cache_type_token">cacheExpired</set>
</condition>
</change>

</input>

Labels (1)
0 Karma

rrovers
Contributor

I think you should use "eval token".

Here is a simplified example of your case:

<dashboard>
<label>Test</label>
<init>
<unset token="cache_type"></unset>
<unset token="cache_type_token"></unset>
</init>
<fieldset>
<input type="dropdown" token="cache_type" searchWhenChanged="true">
<change>
<condition match=" $cache_type$ == &quot;ContextualLineCache*&quot; ">
<eval token="cache_type_token">0</eval>
</condition>
<condition>
<eval token="cache_type_token">$cache_type$</eval>
</condition>
</change>
<label>Choose which type of cache to view</label>
<choice value="*UTable-*">Utilisation Table</choice>
<choice value="ContextualLineCache*">Contextual Line Cache</choice>
<choice value="GlobalRuleCache*">Global Rule Cache</choice>
<choice value="RTLIM*">RTLIM</choice>
<choice value="BATCH*">BATCH</choice>
<choice value="COB*">COB</choice>
<choice value="EOM*">EOM</choice>
<choice value="*">ALL</choice>
<default>Utilisation Table</default>

</input>
</fieldset>
<row>
<html>
cache_type: $cache_type$ cache_type_token: $cache_type_token$
</html>
</row>
</dashboard>

0 Karma

_pravin
Contributor

@rroversThanks for your response. Actually, I was able to figure out what went wrong.

I was setting the token wrong outside of the condition tags.

<change>
<condition match=" $cache_type$ == &quot;ContextualLineCache*&quot; ">
<eval token="cache_type_token">0</eval>
</condition>
<condition>
<eval token="cache_type_token">cacheExpired</eval>
</condition>
</change>

 

I even tried your code and realised that using eval doesn't set the token rather makes it undefined. Also, since I was making changes in the panel init tags didn't work. Thanks  again.

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...