Dashboards & Visualizations

Set multiple tokens using "condition match"

Engager

To set tokens, I have several "condition match" in a search but, if more than one condition is matched, only the first one seems to work.
To simplify my use case:

        <search>
          <query>index=_internal | stats count by host | table host, count</query>
          <earliest>@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="len($result.host$)!=0">
              <set token="showtab1">t1</set>
            </condition>
            <condition match="len($result.count$)!=0">
              <set token="showtab2">t2</set>
            </condition>
          </done>
        </search>

What I expect is that both tokens will be set (both result.host and result.count exist and have a value).
However, only "showtab1" is set.

To my surprise, if I swap the conditions order:

        [...]
          <done>
            <condition match="len($result.count$)!=0">
              <set token="showtab2">t2</set>
            </condition>
            <condition match="len($result.host$)!=0">
              <set token="showtab1">t1</set>
            </condition>
          </done>
        [...]

Now, "showtab2" is set (and "showtab1" is unset...)

What I'm missing here?

1 Solution

Champion

The issue is only one condition is ever executed. They are like if, else-if, else structures.

So you need to combine the two outcomes in one condition and then separate them out.

    <condition match="len($result.host$)!=0 AND len($result.count$)!=0">
        <set token="showtab1">t1</set>
        <set token="showtab2">t2</set>
    <condition match="len($result.host$)!=0">
        <set token="showtab1">t1</set>
    </condition>
    <condition match="len($result.count$)!=0">
        <set token="showtab2">t2</set>
    </condition>

View solution in original post

Esteemed Legend

I have a better answer than multiplexing logic: multiple <change> sections, like this:

<change>
   <condition match="len($result.host$)!=0">
      <set token="showtab1">t1</set>
   </condition>
   <condition>
      <unset token="showtab1"></unset>
   </condition>
</change>
<change>
   <condition match="len($result.count$)!=0">
      <set token="showtab2">t2</set>
   </condition>
   <condition>
      <unset token="showtab2"></unset>
   </condition>
</change>

In the case of 2x2 like this either solution is about the same. However when you scale to a much larger matrix of fields and values, this solution is waaaaaaaaaaaaaaaaay better.

0 Karma

Engager

According to the form documentation you can only have one change block. https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/PanelreferenceforSimplifiedXML#change_.28form...

0 Karma

Esteemed Legend

Please post the text, too. I read the link and other than the use of the definite article "the", which only implies a constraint, I do not see a limitation listed. In any case, it does work and I often use it.

0 Karma

Champion

The issue is only one condition is ever executed. They are like if, else-if, else structures.

So you need to combine the two outcomes in one condition and then separate them out.

    <condition match="len($result.host$)!=0 AND len($result.count$)!=0">
        <set token="showtab1">t1</set>
        <set token="showtab2">t2</set>
    <condition match="len($result.host$)!=0">
        <set token="showtab1">t1</set>
    </condition>
    <condition match="len($result.count$)!=0">
        <set token="showtab2">t2</set>
    </condition>

View solution in original post

Engager

It doesn't allow me to open two conditions and only close one. (on line 6.)
How did you get it to run when the open/close tags are not complete?

0 Karma

Engager

It works. Many thanks.

0 Karma

Explorer

I am facing same kind of problem, please correct my code where I am doing wrong -

  <label>Select Category</label>
  <choice value="capability">CAPABILITY</choice>
  <choice value="lob">LOB</choice>
  <choice value="service">SERVICE</choice>
  <choice value="client">CLIENT</choice>
  <change>


  <set token="show_capability">true</set>
  </condition>
  <condition>
  <unset token="show_capability"></unset>
  </condition>

  <condition value="lob">
  <set token="show_lobName">true</set>
  </condition>
  <condition>
  <unset token="show_lobName"></unset>
  </condition>
  </change>





  <label>Select capability name:</label>
  <search>
    <query>|inputlookup lookup_STAACapability.csv | dedup Capability | eval Capability1=upper(Capability)| sort Capability1  |  table Capability</query>
  </search>
  <fieldForLabel>Capability</fieldForLabel>
  <fieldForValue>Capability</fieldForValue>
</input>


  <label>Select LOB Name:</label>
  <search>
    <query>|inputlookup lookup_STAALob.csv| dedup LOBName| eval LOBName1=upper(ClientName)|sort LOBName1 | table LOBName</query>
  </search>
  <fieldForLabel>LOBName</fieldForLabel>
  <fieldForValue>LOBName</fieldForValue>
</input>
 </fieldset>
0 Karma