I can't seem to set/unset a token based on whether some search result is equal or not to 1.
Can anybody point out why this doesn't work:
<form>
<label>TEMP Endpoint Processes Clone</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="number" searchWhenChanged="false">
<label>Host count</label>
<default>100</default>
<initialValue>100</initialValue>
</input>
</fieldset>
<row>
<panel>
<html>
<p>host_count=$host_count$</p>
<p>host_count1 is 1=$host_count1$</p>
<p>host_count2 catchall=$host_count2$</p>
<p>gotuniquehost=$gotuniquehost$</p>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<done>
<condition match="$result.host_count$ == 1">
<set token="gotuniquehost">True</set>
<set token="host_count">$result.host_count$</set>
<set token="host_count1">$result.host_count$</set>
</condition>
<condition>
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count2">$result.host_count$</set>
</condition>
</done>
<query>|stats count as host_count | eval host_count=$number$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
And yet this is working:
<form>
<label>TEMP Endpoint Processes Clone</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="number" searchWhenChanged="false">
<label>Host count</label>
<default>100</default>
<initialValue>100</initialValue>
</input>
</fieldset>
<row>
<panel>
<html>
<p>host_count=$host_count$</p>
<p>host_count1 gt 1=$host_count1$</p>
<p>host_count2 lt 1=$host_count2$</p>
<p>host_count3 catchall=$host_count2$</p>
<p>gotuniquehost=$gotuniquehost$</p>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<done>
<condition match="$result.host_count$ > 1">
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count1">$result.host_count$</set>
</condition>
<condition match="$result.host_count$ < 1">
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count2">$result.host_count$</set>
</condition>
<condition>
<set token="gotuniquehost">True</set>
<set token="host_count">$result.host_count$</set>
<set token="host_count3">$result.host_count$</set>
</condition>
</done>
<query>|stats count as host_count | eval host_count=$number$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
I run splunk enterprise 7.3.3. This seems to be a bug.
Hi
Check this condition <condition match="$result.host_count$ == "1"">
it seems you are getting result.host_count
as string.
Hi
Check this condition <condition match="$result.host_count$ == "1"">
it seems you are getting result.host_count
as string.
Thanks, that works!