if then else dashboard help

[sgro777]

I'm very new to Splunk.  I have two tokens as input to a dashboard and want to change a query based on which one is entered.  

My base query (with no dashboard) 

eventtype=builder user_id IN (<value1>, <value2>, etc.) | eval .....

I created a dashboard and want to use tokens for the input.  

token1=$id$
token2=$email$

If the token1 has data, I want to execute

eventtype=builder user_id IN ($id$) | eval....

 otherwise, I want to execute 

eventtype=builder user_mail in $email$ | eval .....

[ITWhisperer]

Your issue may be to do with what you do if the user has not selected a value for either token. A dashboard would normal wait for the user to make a selection. Handling tokens is easier in Classic SimpleXML dashboards than currently available in Studio. Is this an option for you?

[sgro777]

If I can't figure it out, I'll try the simple dashboard.

[gcusello]

Hi @sgro777 ,

did you tried with:

eventtype=builder (user_id IN ($id$) OR user_mail in $email$)
| eval .....

?

Ciao.

Giuseppe

[sgro777]

I tried this but it would not work. 

eventtype=builder (user_id IN ($id$) OR user_mail in $email$)
| eval .....

I also tried eventtype=builder ((user_id IN ($id$) OR (user_mail IN ($email$))) | eval ... but that only works if both tokens are populated.

[gcusello · Accepted solution]

Hi @sgro777 ,

sorry, my error, please try:

eventtype=builder (user_id IN ($id$) OR user_mail IN ($email$))
| eval ...

Ciao.

Giuseppe

[sgro777]

THANK YOU!

[gcusello]

Hi @sgro777 ,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉