Dashboards & Visualizations
Highlighted

Tokens set by "Condition match" are not working in my dashboard

Explorer

I try to use condition match=" " to check the value of the "range" field in my search and display a table according to icon status.

<panel>
      <html>
        <h2>Title</h2>
      </html>
      <search>
        <query>myquery | rangemap field=Status low=0-1 high2=2-3 severe=4-5 default=low</query>
        <earliest>-24h</earliest>
        <latest>now</latest>        
        <preview>
          <set token="range2">$result.range$</set>        
       </preview>
          <condition match="'result.range' == high2">
            <set token="show_tab1">true</set>
            <unset token="show_tab1"></unset>
          </condition>
          <condition match="'result.range' == severe">
            <set token="show_tab2">true</set>
            <unset token="show_tab2"></unset>
          </condition>
      </search>
            <html>
                <div class="custom-result-value icon-only $range2$"></div>
            </html>
       <table depends="$show_tab1$">
         <search>
           <query>mytable1query</query>
            <earliest>-24h</earliest>
            <latest>now</latest>
         </search>
       </table>
       <table depends="$show_tab2$">
         <search>
           <query>mytable2query</query>
            <earliest>-24h</earliest>
            <latest>now</latest>
         </search>
       </table>
</panel>

Can someone help me to understand why I can not get the value of the two tokens created by condition match=" "?

0 Karma
Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Champion

try using this block where you have preview

         <done>
           <condition match="'result.range' == high2">
             <set token="range2">$result.range$</set>        
             <set token="show_tab1">true</set>
             <unset token="show_tab1"></unset>
           </condition>
           <condition match="'result.range' == severe">
             <set token="range2">$result.range$</set>        
             <set token="show_tab2">true</set>
             <unset token="show_tab2"></unset>
           </condition>
        </done>

View solution in original post

Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Explorer

Thank you very much. It works correctly.
I do not know the <done>. What is its function and where can I find documentation?

0 Karma
Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Champion

Please see this link http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/EventHandlerReference for more information about done and other event handlers for searches.

Also, please mark my answer as accepted. Thank you.

0 Karma
Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Explorer

Sorry rjthibod, finally it was not good. I forgot to change the name of the token in my table. The two tokens are not evaluated with condition match = "". I do not understand why.

0 Karma
Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Champion

I am afraid I don't know what you mean. Can you restate the issue?

0 Karma
Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Explorer

To see if the tokens "showtab1" and showtab2 "are calculated with condition match = "", I check the display of the value of the tokens" range2 "and" showtab1 "just after the display of the icon state. it appears that the token "showtab" does not display "true" and the table requested when $range2$ = high2.
Here is my code:

<done>
          <condition match="'range2' == high2">
            <set token="showtab1">true</set>
            <unset token="show_tab1"></unset>
          </condition>
          <condition match="'range2' == severe">
            <set token="showtab2">true</set>
            <unset token="show_tab2"></unset>
          </condition>
        </done>
      </search>
            <html>
                <div class="custom-result-value icon-only $range2$"></div>
                <li>$showtab1$</li>
                <li>$range2$</li>
            </html>
       <table depends="$showtab1$">
         <search>
           <query>my tab query</query>
            <earliest>-24h</earliest>
            <latest>now</latest>
         </search>
       </table>

I'm more clear in my explanation?

0 Karma
Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Champion

which version of splunk are you using? if 6.3 or 6.4, try using finalized instead of done. If 6.5, then you should be using done and the issue is something else.

0 Karma
Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Explorer

My Splunk version is 6.3.1 and I replaced done with finalized but the result does not change. I have no more idea.

0 Karma
Highlighted

Re: Tokens set by "Condition match" are not working in my dashboard

Champion

Are you sure the search is even running? Looking at your XML you have the search element directly as a child to a panel element. You should be putting the search under a view object like table.

Try wrapping your search inside of a table element, and put depends on the table to hide it. Something like this.

  <panel>
       <html>
         <h2>Title</h2>
       </html>
       <table depends="$hidden$">
         <search>
           <query>myquery | rangemap field=Status low=0-1 high2=2-3 severe=4-5 default=low</query>
           <earliest>-24h</earliest>
           <latest>now</latest>        
         <finalize>
           <condition match="'result.range' == high2">
             <set token="range2">$result.range$</set>        
             <set token="show_tab1">true</set>
             <unset token="show_tab1"></unset>
           </condition>
           <condition match="'result.range' == severe">
             <set token="range2">$result.range$</set>        
             <set token="show_tab2">true</set>
             <unset token="show_tab2"></unset>
           </condition>
         </finalized
       </search>
     </table>
     <html>
       <div class="custom-result-value icon-only $range2$"></div>
     </html>
     <table depends="$show_tab1$">
       <search>
         <query>mytable1query</query>
           <earliest>-24h</earliest>
           <latest>now</latest>
        </search>
      </table>
      <table depends="$show_tab2$">
        <search>
          <query>mytable2query</query>
          <earliest>-24h</earliest>
          <latest>now</latest>
        </search>
      </table>
  </panel>
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.