Dashboards & Visualizations
Highlighted

Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Motivator

The below used to work in previous version of SPLUNK before 6.5.
It is a drop-down that gets populated from a lookup.
I want to check if the user picks "Add new project" , however, now it is automatically picking it without the user interacting.

Has something changed in SPLUNK 6.5, as this has been working for multiple versions us to now?

    <label>Select which project this applies to</label>
    <search>
      <!-- Get a list of existing projects, plus two static values at the end: "Add new project", and "Remove from project" -->
      <query>| makeresults annotate=false count=1 | eval log_drop_name="$host_token$" | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | eval project = if(isnull(project),"",project) | inputlookup append=true PROJECT_GROUPINGS.csv | append [ | makeresults annotate=false count=1 | eval project="Remove from project" ] | append [ | makeresults annotate=false count=1 | eval project="Add new project" ] | table project | dedup project | head $projects_refresher$</query>
    </search>
    <fieldForLabel>project</fieldForLabel>
    <fieldForValue>project</fieldForValue>
    <selectFirstChoice>true</selectFirstChoice>
    <change>
      <condition value="Add new project">
        <set token="new_project_input">true</set>

        <unset token="form.new_project_input_text"></unset>

        <unset token="known_issues_project"></unset>
        <unset token="execute_add_known_issue"></unset>

        <unset token="execute_add_all_issues"></unset>
      </condition>
      <condition match="NOT value = 'Add new project'">
        <unset token="new_project_input"></unset>

        <eval token="known_issues_project">if('value'="",null,'value')</eval>

        <unset token="execute_add_known_issue"></unset>
        <unset token="execute_add_all_issues"></unset>
      </condition>
    </change>
  </input>

The query results are the following

| makeresults annotate=false count=1 | eval log_drop_name="$host_token$" | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | eval project = if(isnull(project),"",project) | inputlookup append=true PROJECT_GROUPINGS.csv | append [ | makeresults annotate=false count=1 | eval project="Remove from project" ] | append [ | makeresults annotate=false count=1 | eval project="Add new project" ] | table project | dedup project | head $projects_refresher$

NPC
Scotia-Errors
Add new project
Remove from project

SO "Add new project" is in the query, however, I need the end user to pick it before it drives other tokens.

All help is great as i have tried a few things...

0 Karma
Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Legend

Take out

<selectFirstChoice>true</selectFirstChoice>



| eval message="Happy Splunking!!!"


Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Champion

Or change it to "false" to make it explicit

0 Karma
Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Motivator

Sorry but this does not work.

"newprojectinput" is been set to true!

For some reason in the new SPLUNK 6.5 the value is set as "Add new Project", even do nothing has been picked? This worked in other version, so i am thinking of reporting it as a bug.

    <change>
      <condition value="Add new project">
        <set token="new_project_input">true</set>
0 Karma
Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Legend

Sorry @robertlynch2020 , you have accepted wrong answer. Please unaccept this and accept nfilippi's Answer.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Motivator

Hi - I have done this now: FYI this option was not available to be 30 minutes ago. His answer has been moved into an answer and not a comment off an answer.

But its all fixed now, so cheers for your help 🙂

0 Karma
Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Esteemed Legend

If you create a run-anywhere example (using index=_*, getting rid of lookup and inputlookup, etc.), and post a complete XML, then I (and probably others) will try to help.

0 Karma
Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

0 Karma
Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Splunk Employee
Splunk Employee

Have you tried something like this:

<condition match="value != &quot;Add new project&quot;">

View solution in original post

Highlighted

Re: Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

Motivator

Hi - Just getting to this NOW. Looks like this is it. Thanks very much

0 Karma