I try to use condition match=" "
to check the value of the "range" field in my search and display a table according to icon status.
<panel>
<html>
<h2>Title</h2>
</html>
<search>
<query>myquery | rangemap field=Status low=0-1 high2=2-3 severe=4-5 default=low</query>
<earliest>-24h</earliest>
<latest>now</latest>
<preview>
<set token="range2">$result.range$</set>
</preview>
<condition match="'result.range' == high2">
<set token="show_tab1">true</set>
<unset token="show_tab1"></unset>
</condition>
<condition match="'result.range' == severe">
<set token="show_tab2">true</set>
<unset token="show_tab2"></unset>
</condition>
</search>
<html>
<div class="custom-result-value icon-only $range2$"></div>
</html>
<table depends="$show_tab1$">
<search>
<query>mytable1query</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
</table>
<table depends="$show_tab2$">
<search>
<query>mytable2query</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
</table>
</panel>
Can someone help me to understand why I can not get the value of the two tokens created by condition match=" "
?
try using this block where you have preview
<done>
<condition match="'result.range' == high2">
<set token="range2">$result.range$</set>
<set token="show_tab1">true</set>
<unset token="show_tab1"></unset>
</condition>
<condition match="'result.range' == severe">
<set token="range2">$result.range$</set>
<set token="show_tab2">true</set>
<unset token="show_tab2"></unset>
</condition>
</done>
The condition block is part of the . I am using splunk 6.5
I am sorry but your response got cut off.
Where are you defining "form.Response_Resolution" that is referenced in your condition block?
That is part of the URL.
(1) As part of chart drilldown I am navigating to a new screen
(2) The URL that is invoked is ticket_details_pop_up?form.Severity=Sev%202&form.Response_Resolution=Response%20Met%20%25
(3) On the ticket details pop up screen, I am trying to get this token and set additional tokens
That token only means something if there is an input on the dashboard that is named "Response_Resolution" or you are grabbing the URL and putting it into a token using JS.
At this point, I think you need to put your question as a separate thread and post all of your XML with the full details of the use case. Continuing this on in the comment section here is not an efficient or effective use of the Answers forum.
Please see this link http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/EventHandlerReference for more information about done
and other event handlers for searches.
Also, please mark my answer as accepted. Thank you.