- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Problem with Token condition match
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I am trying to set a token to display a part of my dashboard only if the value of one of the field I've got in my search is equal to a certain string.
Here is an example:
<search>
<query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false"))</query>
<done>
<condition match="'result.is_Valid'==true">
<set token="Display_Html">true</set>
</condition>
</done>
</search>
However, this condition doesn't seem to work. I can clearly see my makeresults command works in a search or even in the dashboard, but the condition + set token doesn't seem to work.
Does anybody have got any idea what I'm doing wrong please?
Thank you
Regards
Laurent
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to quote the right hand side of the condition, true, with " so it should be
<search>
<query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false")).
</query>
<done>
<condition match="'result.is_Valid'=="true"">
<set token="Display_Html">true</set>
</condition>
</done>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to quote the right hand side of the condition, true, with " so it should be
<search>
<query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false")).
</query>
<done>
<condition match="'result.is_Valid'=="true"">
<set token="Display_Html">true</set>
</condition>
</done>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
And finally I just managed to understand and make it work.
I was testing the token on a <html><h1>$Display_Html$</h1></html> part of the dashboard, however this was loading before the search managed to finish and set the token.
I used a depends="$Display_Html$" and now the panel only appears whenever the token had time to be set.
Bottom line it must have been working for a while but couldn't see the token being set.
Also the " seems to make it work.
Thank you again. Problem solved!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
So I had some play around this at work this morning and it seems if I'm using a test dashboard with nothing else on version 7.3.5, it does work.
However as my other dashboard is more complex and one of the field I'm testing depends on another query, I guess that's the problem. Maybe Splunk is loading at the same time both queries and the condition is not possible as the first query is still not completed yet.
I am using <done> tags on both queries which should make it work but it seems not.
I'm going to explore the idea of only triggering the second search only if the first one is completed.
Thank you for your help @richgalloway and @bowesmana at least you proved it should be working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of Splunk are you using? This code works find under 8.1.
<dashboard>
<label>test2</label>
<row>
<panel>
<table>
<search>
<query>| makeresults |eval is_Valid=(if("Valid" == "Valid","true","false"))</query>
<done>
<condition match="'result.is_Valid'==true">
<set token="Display_Html">true</set>
</condition>
</done>
</search>
</table>
</panel>
</row>
</dashboard>If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Thank you for your time. I am working with 7.3.5 (don't have the choice) and it did not seem to work.
I'll check in a separate test dashboard at work tomorrow and on a fresh install of v8.x tonight.
Thank you for your time. Will let you know ASAP.
Regards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just tried on v8.0.4.1 and it's still not working.
I manage to get that field is_OK populated but the second token in the condition doesn't get set.
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
