Hi,
I am trying to set a token to display a part of my dashboard only if the value of one of the field I've got in my search is equal to a certain string.
Here is an example:
<search>
<query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false"))</query>
<done>
<condition match="'result.is_Valid'==true">
<set token="Display_Html">true</set>
</condition>
</done>
</search>
However, this condition doesn't seem to work. I can clearly see my makeresults command works in a search or even in the dashboard, but the condition + set token doesn't seem to work.
Does anybody have got any idea what I'm doing wrong please?
Thank you
Regards
Laurent
You need to quote the right hand side of the condition, true, with " so it should be
<search>
<query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false")).
</query>
<done>
<condition match="'result.is_Valid'=="true"">
<set token="Display_Html">true</set>
</condition>
</done>
</search>
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
You need to quote the right hand side of the condition, true, with " so it should be
<search>
<query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false")).
</query>
<done>
<condition match="'result.is_Valid'=="true"">
<set token="Display_Html">true</set>
</condition>
</done>
</search>
And finally I just managed to understand and make it work.
I was testing the token on a <html><h1>$Display_Html$</h1></html> part of the dashboard, however this was loading before the search managed to finish and set the token.
I used a depends="$Display_Html$" and now the panel only appears whenever the token had time to be set.
Bottom line it must have been working for a while but couldn't see the token being set.
Also the " seems to make it work.
Thank you again. Problem solved!
Hi,
So I had some play around this at work this morning and it seems if I'm using a test dashboard with nothing else on version 7.3.5, it does work.
However as my other dashboard is more complex and one of the field I'm testing depends on another query, I guess that's the problem. Maybe Splunk is loading at the same time both queries and the condition is not possible as the first query is still not completed yet.
I am using <done> tags on both queries which should make it work but it seems not.
I'm going to explore the idea of only triggering the second search only if the first one is completed.
Thank you for your help @richgalloway and @bowesmana at least you proved it should be working.
What version of Splunk are you using? This code works find under 8.1.
<dashboard>
<label>test2</label>
<row>
<panel>
<table>
<search>
<query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false"))</query>
<done>
<condition match="'result.is_Valid'==true">
<set token="Display_Html">true</set>
</condition>
</done>
</search>
</table>
</panel>
</row>
</dashboard>
Hi,
Thank you for your time. I am working with 7.3.5 (don't have the choice) and it did not seem to work.
I'll check in a separate test dashboard at work tomorrow and on a fresh install of v8.x tonight.
Thank you for your time. Will let you know ASAP.
Regards.
Just tried on v8.0.4.1 and it's still not working.
I manage to get that field is_OK populated but the second token in the condition doesn't get set.