Dashboards & Visualizations

What is wrong with the match condition in the following input that is not setting accountselectedToken to false?

jprovenzale
Explorer

What is wrong with the Match Condition in the following input that is not setting accountselectedToken to False? The value is :      accountselectedToken = True.
It is failing the match condition and performing the second condition i.e. setting accountToken="*"



<input type="multiselect" token="shardToken" searchWhenChanged="false">
       <label>Shards</label>
       <delimiter>,</delimiter>
       <fieldForLabel>shardaccount</fieldForLabel>
       <fieldForValue>shard</fieldForValue>
  <search>
     <query>| inputlookup ShardList.csv
        | eval shardaccount=shard + " - " + account</query>
       <earliest>@d</earliest>
       <latest>now</latest>
  </search>
<change>
      <condition match="$accountselectedToken$==True">
         <set token="accountselectedToken">False</set>
     </condition>
    <condition>
        <set token="accountToken">"*"</set>
   </condition>

Tags (2)
0 Karma

jprovenzale
Explorer

Initially it is set here when the dashboard loads.

<init>
    <set token="accountToken">"*"</set>
    <set token="accountselectedToken">False</set>
</init>

There is an Accounts panel that displays the top performing account for each shard. When clicking on the account I want, the accountselectedToken is set to True.

This is because I also update the Shards multi-select box with the Shard the account is on. So in this changed condition, I don't want to set the accountToken to "*". I simply want to unset the accountselectedToken.

accountselectedToken is not a string value. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

accountselectedToken is a string value - that is what <set> does

<set token="accountselectedToken">False</set>

If you don't have anywhere that sets accountselectedToken to True, it will not match the condition

If you want to unset a token, use <unset>

<unset token="accountselectedToken"/>

 

0 Karma

jprovenzale
Explorer

Ok, I have set the Match statement to look like this.

<condition match="$accountselectedToken$=='True'">

It still does not recognise the match condition.

 

The accountselectedToken is set when I click on the account value in the Accounts panel. It is a drilldown.

This then changes the dropdown panel to the shard value the account is on thus invoking the change condition, but it still sets the accountToken to "*". The Match condition is still failing.

When I mentioned unset, I actually meant set the value to False.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Single quotes are used to refer to a field or token - use &quot; as I suggested for embedded XML encoded double quotes needed for a string

0 Karma

jprovenzale
Explorer

Thanks very much. All is working.

Can't believe it was that simple.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Where is accountselectedToken being set?

Also, try putting quotes around True if it is a string

<condition match="$accountselectedToken$==&quot;True&quot;">
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...