Can you help me with this.
I have this extra search in the xml, just for evaluating tokens
am trying this, but its not working
<search> <query>|inputlookup abc.csv |search Field1="$token1$" Field2="$token2$" Field3="$token3$"</query> <earliest>-15m</earliest> <latest>now</latest> <done> <eval token="token4">if('result.Field2' == *,"*","'result.Field4'")</eval> </done> </search>
the lookup file has Field1, Field2, Field3, Field4 values
when the above search runs with tokens passed - token1,token2,token3 -- it lists out values the specific Field4 value matching with Field3,Field2,Field1 Value
& the tokens token1, token2, token3 are coming from inputs in the same XML.
1) if (Field2 or token2) AND (Field3 or token3) is not *, need to set the token4 value as Field4 value 2) if Field2 or token2 is *, need to set the token4 value as *
fields are there in lookup file abc.csv
& the above tokens are coming from inputs in the XML.
lookup flle contain fields Field1,Field2,Field3,Field4
If all that you need is to know the values of all of your tokens, then why not just use a tool that does that automatically for you? Try
Developer Gadgets App for Splunk