Dashboards & Visualizations

Why are Splunk multiple 'condition match' statements not working in my xml dashboard?

johnmvang
Path Finder

Hello,

I have the following dashboard code:

<progress>
<condition match="'job.resultCount' > 0">
              <set token="set_cp1_tok">$result.cp1$</set>
              <set token="set_cp2_tok">$result.cp2$</set>
              <set token="set_cp3_tok">$result.cp3$</set>
              <set token="set_pa1_tok">$result.pa1$</set>
              <set token="set_pa2_tok">$result.pa2$</set>
              <set token="set_pa3_tok">$result.pa3$</set>
              <set token="set_ws1_tok">$result.ws1$</set>
              <set token="set_ws2_tok">$result.ws2$</set>
              <set token="set_ws3_tok">$result.ws3$</set>
              <set token="set_dct1_tok">$result.dct1$</set>
              <set token="set_dct2_tok">$result.dct2$</set>
              <set token="set_dct3_tok">$result.dct3$</set>
              <set token="set_asm1_tok">$result.asm1$</set>
              <set token="set_asm2_tok">$result.asm2$</set>
              <set token="set_asm3_tok">$result.asm3$</set>
              <set token="set_asm11_tok">$result.asm11$</set>
              <set token="set_asm22_tok">$result.asm22$</set>
              <set token="set_desc_tok">$result.description$</set>
              <set token="edit_id_tok">$result.id$</set>
              <set token="show_loading">true</set>
              <set token="set_key_tok">$result.key$</set>
            </condition>
            <condition match="'result.custom_r1p1_vi'==&quot;line&quot;">
              <set token="show_row1p1_line">true</set>
            </condition>
            <condition match="'result.custom_r1p2_vi'==&quot;line&quot;">
              <set token="show_row1p2_line">true</set>
            </condition>
            <condition match="'result.custom_r1p3_vi'==&quot;line&quot;">
              <set token="show_row1p3_line">true</set>
            </condition>
</progress>

and only the first condition match statement is applying. The other 3 condition matches do not apply when the results are there, and the tokens should all be true.

I saw this answer, but every time i try to do it, i get XML errors stating i'm missing closing tags:

https://answers.splunk.com/answers/575552/set-multiple-tokens-using-condition-match.html

What am i doing wrong?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@johnmvang

If your search has data then the first condition will be executed; otherwise, it won't be. You have to write conditions in such a manner that will set your tokens for 'job.resultCount' > 0. Just remove the first condition and merge it with the remaining.

something like.

<condition match="''job.resultCount' > 0 AND result.custom_r1p1_vi'==&quot;line&quot;">
<set token="show_row1p1_line">true</set>
SET OTHER TOKENS
</condition>

Just let me know if you need further assistance.

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@johnmvang

If your search has data then the first condition will be executed; otherwise, it won't be. You have to write conditions in such a manner that will set your tokens for 'job.resultCount' > 0. Just remove the first condition and merge it with the remaining.

something like.

<condition match="''job.resultCount' > 0 AND result.custom_r1p1_vi'==&quot;line&quot;">
<set token="show_row1p1_line">true</set>
SET OTHER TOKENS
</condition>

Just let me know if you need further assistance.

Thanks

0 Karma

johnmvang
Path Finder

thanks this works, i get it now. if you want to reply with an answer i can mark it as answered.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@johnmvang

Glad to help you. Please accept the answer and upvote.

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...