Dashboards & Visualizations

Use nested conditions in xml dashboard

Engager

Hi,

I have a dashboard with inputs and I use condition to set some tokens, in the change statement. I have a first condition that solve the case of the default value and I have a second condition related to an other token from another input.
Finally I have a last condition statement working as an else to set tokens in other case than the default value.

My problem is that in the second conditions I set some tokens that I set again in the last statement because they correspond to the other case than the first.
The optimal solution will be to nest the second condition into the last since it's just a specifical case of the last.

Is it possible to nest conditions because I don't find a way to do this

Tags (3)
0 Karma

Communicator

base search | search tokan1="$A$" OR tokan2="$B$" OR tokan3="$C$"

0 Karma

Engager

I don't understand how to do this and why it is solve my problem

0 Karma

Super Champion

can you provide some of your xml (stripped of any sensitive data) to make it easier to help?

0 Karma

Engager

< input type="dropdown" token="srcIP" >
< label>IP source< /label>
< fieldForLabel>res< /fieldForLabel>
< fieldForValue>srcip< /fieldForValue>
< search >
< query >
| eval res=src
ip . " (" . hostnamesrc . ")"
| table res, src
ip
< /query>
< earliest>0< /earliest>
< latest>< /latest>
< /search >
< choice value="none">Aucune< /choice>
< default>none< /default>
< change >
< condition label="Aucune">
< unset token="showpanel1">< /unset>
< set token="titlelabelsrc">< /set>
< set token="srcbyclause">< /set>
< set token="srcset">false< /set>
< set token="src
ipsearch">< /set>
< /condition>
< condition match="'dest
set' == "true"">
< set token="srcbyclause">< /set>
< set token="destbyclause">< /set>
< set token="showpanel1">true< /set>
< set token="titlelabelsrc">depuis $label$< /set>
< set token="srcset">true< /set>
< set token="src
ipsearch">srcip=$value$< /set>
< / condition>
< condition>
< set token="showpanel1">true< /set>
< set token="titlelabelsrc">depuis $label$< /set>
< set token="srcbyclause">by dest< /set>
< set token="srcset">true< /set>
< set token="src
ipsearch">srcip=$value$< /set>
< / condition>
< /change>
< /input>
< input type="dropdown" token="destIP" >
< label>IP destination< /label>
< fieldForLabel>res< /fieldForLabel>
< fieldForValue>destip< /fieldForValue>
< search>
< query>
| eval res=dest
ip . "(" . hostnamedest . ")"
| table res, dest
ip
< /query>
< earliest>0< /earliest>
< latest>< /latest>
< /search >
< choice value="none">Aucune< /choice>
< default>none< /default>
< change>
< condition label="Aucune">
< unset token="showpanel2">< /unset>
< set token="titlelabeldest">< /set>
< set token="destbyclause">< /set>
< set token="destset">false< /set>
< set token="dest
ipsearch">< /set>
< /condition>
< condition match="'src
set' == "true"">
< set token="srcbyclause">< /set>
< set token="destbyclause">< /set>
< set token="showpanel2">true< /set>
< set token="titlelabeldest">vers $label$< /set>
< set token="destset">true< /set>
< set token="dest
ipsearch">destip=$value$< /set>
< /condition>
< condition>
< set token="showpanel2">true< /set>
< set token="titlelabeldest">vers $label$< /set>
< set token="destbyclause">by src< /set>
< set token="destset">true< /set>
< set token="dest
ipsearch">destip=$value$< /set>
< /condition>
< /change>
< /input>

The search using this token :
< query>
$srcipsearch$ $destipsearch$
| stats sparkline count $srcbyclause$ $destbyclause$
< /query>

This input is populated by a search that return the IP source available. The second input is the same except it is for IP destination.
The first condition handle the default case that is none. At first I just have the last condition that handle the other cases. But I need to add the second condition to set the clause by of a stats command in a search. I want that if the first input as another choice than default it set the a token to "by dest" (for the search), reciprocally "by src" for the second input and no by clause if the two inputs are different from default. So I add the second condition to reset the token as empty if the other input as a choice different from the default

0 Karma