Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- I have two conditions that need to be compared to ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have two conditions needs to be compared to set token value in the second dropdown. First condition from dropdown 1 (token="view") and second condition from dropdown 2 ( token="category"). Please tell us if there is any alternative way of doing this.
<input type="dropdown" token="view">d<label>View</label>
<choice value="A">A</choice>
<choice value="B">B</choice>
<default>A</default>
</input>
<input type="dropdown" token="category">
<label>Category</label>
<choice value="X">X</choice>
<choice value="Y">Y</choice>
<change>
<!-- Something like below condition i need -->
<condition value="X">
<condition match="$view% == 'A'">
<set token="showX">Test1</set>
</condition>
<condition match="$view% == 'B'">
<set token="showX">Test2</set>
</condition>
</condition>
<condition value="Y">
<unset token="showX">Test 3</unset>
</condition>
</change>
</input>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@handsomehari, try the following to use <eval> tag in Simple XML to set the token value based on condition.
PS: Since your showX token is depended on both Dropdowns, you would also need to created <change> Event Handler for view, dropdown to set and unset showX token similar (but inverse) to the logic in the category dropdown:
<fieldset submitButton="false">
<input type="dropdown" token="view" searchWhenChanged="true">
<label>View</label>
<choice value="A">A</choice>
<choice value="B">B</choice>
<default>A</default>
<change>
<condition value="A">
<eval token="showX">case($category$=="X","Test1",$category$=="Y",$showX$)</eval>
</condition>
<condition value="B">
<eval token="showX">case($category$=="X","Test2",$category$=="Y",$showX$)</eval>
</condition>
</change>
</input>
<input type="dropdown" token="category" searchWhenChanged="true">
<label>Category</label>
<choice value="X">X</choice>
<choice value="Y">Y</choice>
<change>
<condition value="X">
<eval token="showX">case($view$=="A","Test1",$view$=="B","Test2")</eval>
</condition>
<condition value="Y">
<unset token="showX"></unset>
</condition>
</change>
</input>
</fieldset>
PS: The $category$=="Y",$showX$, unsets the showX token as per requirement.
Following HTML Panel can be added to test the tokens:
<row>
<panel>
<html>
<b>Token Values</b><br/>
<div>
view: $view$<br/>
category: $category$<br/>
showX: $showX$<br/>
</div>
</html>
</panel>
</row>
Please try out and confirm.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@handsomehari, try the following to use <eval> tag in Simple XML to set the token value based on condition.
PS: Since your showX token is depended on both Dropdowns, you would also need to created <change> Event Handler for view, dropdown to set and unset showX token similar (but inverse) to the logic in the category dropdown:
<fieldset submitButton="false">
<input type="dropdown" token="view" searchWhenChanged="true">
<label>View</label>
<choice value="A">A</choice>
<choice value="B">B</choice>
<default>A</default>
<change>
<condition value="A">
<eval token="showX">case($category$=="X","Test1",$category$=="Y",$showX$)</eval>
</condition>
<condition value="B">
<eval token="showX">case($category$=="X","Test2",$category$=="Y",$showX$)</eval>
</condition>
</change>
</input>
<input type="dropdown" token="category" searchWhenChanged="true">
<label>Category</label>
<choice value="X">X</choice>
<choice value="Y">Y</choice>
<change>
<condition value="X">
<eval token="showX">case($view$=="A","Test1",$view$=="B","Test2")</eval>
</condition>
<condition value="Y">
<unset token="showX"></unset>
</condition>
</change>
</input>
</fieldset>
PS: The $category$=="Y",$showX$, unsets the showX token as per requirement.
Following HTML Panel can be added to test the tokens:
<row>
<panel>
<html>
<b>Token Values</b><br/>
<div>
view: $view$<br/>
category: $category$<br/>
showX: $showX$<br/>
</div>
</html>
</panel>
</row>
Please try out and confirm.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks!! It is working for me..
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
