Dashboards & Visualizations

Tokens set by "Condition match" are not working in my dashboard

erwan_raulet
Explorer

I try to use condition match=" " to check the value of the "range" field in my search and display a table according to icon status.

<panel>
      <html>
        <h2>Title</h2>
      </html>
      <search>
        <query>myquery | rangemap field=Status low=0-1 high2=2-3 severe=4-5 default=low</query>
        <earliest>-24h</earliest>
        <latest>now</latest>        
        <preview>
          <set token="range2">$result.range$</set>        
       </preview>
          <condition match="'result.range' == high2">
            <set token="show_tab1">true</set>
            <unset token="show_tab1"></unset>
          </condition>
          <condition match="'result.range' == severe">
            <set token="show_tab2">true</set>
            <unset token="show_tab2"></unset>
          </condition>
      </search>
            <html>
                <div class="custom-result-value icon-only $range2$"></div>
            </html>
       <table depends="$show_tab1$">
         <search>
           <query>mytable1query</query>
            <earliest>-24h</earliest>
            <latest>now</latest>
         </search>
       </table>
       <table depends="$show_tab2$">
         <search>
           <query>mytable2query</query>
            <earliest>-24h</earliest>
            <latest>now</latest>
         </search>
       </table>
</panel>

Can someone help me to understand why I can not get the value of the two tokens created by condition match=" "?

0 Karma
1 Solution

rjthibod
Champion

try using this block where you have preview

         <done>
           <condition match="'result.range' == high2">
             <set token="range2">$result.range$</set>        
             <set token="show_tab1">true</set>
             <unset token="show_tab1"></unset>
           </condition>
           <condition match="'result.range' == severe">
             <set token="range2">$result.range$</set>        
             <set token="show_tab2">true</set>
             <unset token="show_tab2"></unset>
           </condition>
        </done>

View solution in original post

lakshmisri
New Member

The condition block is part of the . I am using splunk 6.5

0 Karma

rjthibod
Champion

I am sorry but your response got cut off.

Where are you defining "form.Response_Resolution" that is referenced in your condition block?

0 Karma

lakshmisri
New Member

That is part of the URL.
(1) As part of chart drilldown I am navigating to a new screen
(2) The URL that is invoked is ticket_details_pop_up?form.Severity=Sev%202&form.Response_Resolution=Response%20Met%20%25
(3) On the ticket details pop up screen, I am trying to get this token and set additional tokens

0 Karma

rjthibod
Champion

That token only means something if there is an input on the dashboard that is named "Response_Resolution" or you are grabbing the URL and putting it into a token using JS.

0 Karma

rjthibod
Champion

At this point, I think you need to put your question as a separate thread and post all of your XML with the full details of the use case. Continuing this on in the comment section here is not an efficient or effective use of the Answers forum.

0 Karma

rjthibod
Champion

Please see this link http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/EventHandlerReference for more information about done and other event handlers for searches.

Also, please mark my answer as accepted. Thank you.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...