Dashboards & Visualizations

Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Motivator

The below used to work in previous version of SPLUNK before 6.5.
It is a drop-down that gets populated from a lookup.
I want to check if the user picks "Add new project" , however, now it is automatically picking it without the user interacting.

Has something changed in SPLUNK 6.5, as this has been working for multiple versions us to now?

    <label>Select which project this applies to</label>
    <search>
      <!-- Get a list of existing projects, plus two static values at the end: "Add new project", and "Remove from project" -->
      <query>| makeresults annotate=false count=1 | eval log_drop_name="$host_token$" | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | eval project = if(isnull(project),"",project) | inputlookup append=true PROJECT_GROUPINGS.csv | append [ | makeresults annotate=false count=1 | eval project="Remove from project" ] | append [ | makeresults annotate=false count=1 | eval project="Add new project" ] | table project | dedup project | head $projects_refresher$</query>
    </search>
    <fieldForLabel>project</fieldForLabel>
    <fieldForValue>project</fieldForValue>
    <selectFirstChoice>true</selectFirstChoice>
    <change>
      <condition value="Add new project">
        <set token="new_project_input">true</set>

        <unset token="form.new_project_input_text"></unset>

        <unset token="known_issues_project"></unset>
        <unset token="execute_add_known_issue"></unset>

        <unset token="execute_add_all_issues"></unset>
      </condition>
      <condition match="NOT value = 'Add new project'">
        <unset token="new_project_input"></unset>

        <eval token="known_issues_project">if('value'="",null,'value')</eval>

        <unset token="execute_add_known_issue"></unset>
        <unset token="execute_add_all_issues"></unset>
      </condition>
    </change>
  </input>

The query results are the following

| makeresults annotate=false count=1 | eval log_drop_name="$host_token$" | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | eval project = if(isnull(project),"",project) | inputlookup append=true PROJECT_GROUPINGS.csv | append [ | makeresults annotate=false count=1 | eval project="Remove from project" ] | append [ | makeresults annotate=false count=1 | eval project="Add new project" ] | table project | dedup project | head $projects_refresher$

NPC
Scotia-Errors
Add new project
Remove from project

SO "Add new project" is in the query, however, I need the end user to pick it before it drives other tokens.

All help is great as i have tried a few things...

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Have you tried something like this:

<condition match="value != &quot;Add new project&quot;">

View solution in original post

Motivator

This worked in the end - Thanks 🙂

 <condition match="value != &quot;Add new project&quot;">

I have no idea why my Orginal code stopped working, but this is doing the trick. Cheers 🙂

0 Karma

0 Karma

SplunkTrust
SplunkTrust

@robertlynch2020... Please upvote @nfilippi comment since his suggested code is what worked for you. Ideally you should have accepted his comment as answer!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Motivator

I was trying to accept his comment, but i cant as its a commend on an answer.
SO i will upvote no worries, but how do i accept his answer ?

0 Karma

Motivator

Unless he re-posts as an answer then i will accept perhaps ?
Im easy, he saved me a lot of work so i defo want to say thanks 🙂

0 Karma

Motivator

for some reason i cant do more - > convert to answer!

0 Karma

Splunk Employee
Splunk Employee

Have you tried something like this:

<condition match="value != &quot;Add new project&quot;">

View solution in original post

Motivator

Hi - Just getting to this NOW. Looks like this is it. Thanks very much

0 Karma

0 Karma

Esteemed Legend

If you create a run-anywhere example (using index=_*, getting rid of lookup and inputlookup, etc.), and post a complete XML, then I (and probably others) will try to help.

0 Karma

0 Karma

SplunkTrust
SplunkTrust

Take out

<selectFirstChoice>true</selectFirstChoice>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Motivator

Sorry but this does not work.

"new_project_input" is been set to true!

For some reason in the new SPLUNK 6.5 the value is set as "Add new Project", even do nothing has been picked? This worked in other version, so i am thinking of reporting it as a bug.

    <change>
      <condition value="Add new project">
        <set token="new_project_input">true</set>
0 Karma

SplunkTrust
SplunkTrust

Sorry @robertlynch2020 , you have accepted wrong answer. Please unaccept this and accept nfilippi's Answer.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Motivator

Hi - I have done this now: FYI this option was not available to be 30 minutes ago. His answer has been moved into an answer and not a comment off an answer.

But its all fixed now, so cheers for your help 🙂

0 Karma

Champion

Or change it to "false" to make it explicit

0 Karma