Dashboards & Visualizations

Tokens set by "Condition match" are not working in my dashboard

erwan_raulet
Explorer

I try to use condition match=" " to check the value of the "range" field in my search and display a table according to icon status.

<panel>
      <html>
        <h2>Title</h2>
      </html>
      <search>
        <query>myquery | rangemap field=Status low=0-1 high2=2-3 severe=4-5 default=low</query>
        <earliest>-24h</earliest>
        <latest>now</latest>        
        <preview>
          <set token="range2">$result.range$</set>        
       </preview>
          <condition match="'result.range' == high2">
            <set token="show_tab1">true</set>
            <unset token="show_tab1"></unset>
          </condition>
          <condition match="'result.range' == severe">
            <set token="show_tab2">true</set>
            <unset token="show_tab2"></unset>
          </condition>
      </search>
            <html>
                <div class="custom-result-value icon-only $range2$"></div>
            </html>
       <table depends="$show_tab1$">
         <search>
           <query>mytable1query</query>
            <earliest>-24h</earliest>
            <latest>now</latest>
         </search>
       </table>
       <table depends="$show_tab2$">
         <search>
           <query>mytable2query</query>
            <earliest>-24h</earliest>
            <latest>now</latest>
         </search>
       </table>
</panel>

Can someone help me to understand why I can not get the value of the two tokens created by condition match=" "?

0 Karma
1 Solution

rjthibod
Champion

try using this block where you have preview

         <done>
           <condition match="'result.range' == high2">
             <set token="range2">$result.range$</set>        
             <set token="show_tab1">true</set>
             <unset token="show_tab1"></unset>
           </condition>
           <condition match="'result.range' == severe">
             <set token="range2">$result.range$</set>        
             <set token="show_tab2">true</set>
             <unset token="show_tab2"></unset>
           </condition>
        </done>

View solution in original post

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...