If statement not working with Tokens in dashboard

[lokeshchanana]

I am making a dashboard with the dropdown input called $searchCriteria$. I am trying to set the value of a search_col based on the value of the $searchCriteria$ token. I have tried the following: 

| eval search_col = if($searchcriteria$ == "s_user", user, path)

| eval search_col = if('$searchcriteria$' == "s_user", user, path)

| eval search_col = if($searchcriteria$ == 's_user', user, path)

| eval search_col = if('$searchcriteria$' == 's_user', user, path)

Even tried 

| eval search_col = if(s_user == s_user, user, path)

The value of search_col is the same as path. 
I have tested, and the value of the $searchcriteria$ is getting set properly.
What am I doing wrong?

[livehybrid]

Hi @lokeshchanana 

Case sensitivity of the token is certainly causing you an issue here, if the token you're setting is "searchCriteria" then your cannot use "searchcriteria".

Also, you can use Token filters to add quotes around the token if you prefer, so

| eval search_col = if($searchCriteria|s$ == "s_user", user, path)

should also be the same as:

| eval search_col = if("$searchCriteria$" == "s_user", user, path)

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[lokeshchanana]

I am sorry for the typing mistake. The Token name is searchcriteria, there is no difference in the case:

I know case difference is an issue, but I have made sure there is no case difference, and I am still having the same issue.

[ITWhisperer]

What exactly is not working? Please share your search where you are using the token?

[ITWhisperer]

Strictly speaking, "$searchCriteria$" is not the same as $searchCriteria|s$ as the |s filter will deal with things such as embedded quotes, whereas just putting the token in double quotes will not. Having said that, in this instance, they are probably equivalent.

[lokeshchanana]

Thanks for your reply. I have checked the case and for the special characters, I even changed the token name from search_criteria to searchcriteria

[PrewinThomas]

@lokeshchanana 

Simple XML tokens are case-sensitive. You must use $searchCriteria$—matching the capitalization in your input name

| eval search_col = if("$searchCriteria$"=="s_user", user, path)

Also you can use case() with token substitution,

| eval search_col = case("$searchCriteria$"=="s_user", user, 1==1, path)

This forces Splunk to treat "$searchCriteria$" as a string literal and compare it properly.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[ITWhisperer]

Almost! Yes, using the correct case for the token is vital, but it is putting the token in double quotes which is also vital. Using case instead of if is not important.

Token values are substituted as a text substitution into the code of the dashboard (whether Studio or SimpleXML) before the dashboard code is executed. For example, if the searchCriteria token from the dropdown had the value "s_user", the

| eval search_col = if($searchCriteria$ == "s_user", user, path)

line would become

| eval search_col = if(s_user == "s_user", user, path)

i.e. if the s_user field has the string value "s_user". Using double quotes

| eval search_col = if("$searchCriteria$" == "s_user", user, path)

gives the line the intended meaning

| eval search_col = if("s_user" == "s_user", user, path)