Deployment Architecture

How to set a token based on another token

k_harini
Communicator

Hi,
I tried to set token based on another token set from drilldown. But the condition match here is not satisfied. can someone please assist
`



|makeresults|eval test= "$form.field3$" |table test


showing

            </condition>
            <condition>
              <set token="hide">hiding</set>
            </condition>
          </preview>
        </search>
      </table>
    </panel>
  </row>`

form.field3 is set on drilldown. if it is null it is going to other condition and not immediate one. I want to hide and show two panels based on this token setting. can some one please assist?

Tags (1)
0 Karma

k_harini
Communicator

Yes.. I used depends for the below panel.. but I want to unset this when another token is set like $field4$ from different panel. That I cannot do directly.. so I tried with condition match..

0 Karma

niketn
Legend

@k_harini, if the panel is supposed to be hidden when form3 dropdown has no value selected, you can code the same directly by adding <depends="$form3$"> to your panel.

<form>
  <label>Set Unset token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field3" searchWhenChanged="true">
      <label></label>
      <choice value="test1">Test 1</choice>
      <choice value="test2">Test 2</choice>
    </input>
  </fieldset>
  <row depends="$field3$">
    <panel>
      <table>
        <search id="test1">
          <query>|makeresults|eval test= "$form.field3$" |table test</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...