Deployment Architecture

How to set a token based on another token

k_harini
Communicator

Hi,
I tried to set token based on another token set from drilldown. But the condition match here is not satisfied. can someone please assist
`



|makeresults|eval test= "$form.field3$" |table test


showing

            </condition>
            <condition>
              <set token="hide">hiding</set>
            </condition>
          </preview>
        </search>
      </table>
    </panel>
  </row>`

form.field3 is set on drilldown. if it is null it is going to other condition and not immediate one. I want to hide and show two panels based on this token setting. can some one please assist?

Tags (1)
0 Karma

k_harini
Communicator

Yes.. I used depends for the below panel.. but I want to unset this when another token is set like $field4$ from different panel. That I cannot do directly.. so I tried with condition match..

0 Karma

niketn
Legend

@k_harini, if the panel is supposed to be hidden when form3 dropdown has no value selected, you can code the same directly by adding <depends="$form3$"> to your panel.

<form>
  <label>Set Unset token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field3" searchWhenChanged="true">
      <label></label>
      <choice value="test1">Test 1</choice>
      <choice value="test2">Test 2</choice>
    </input>
  </fieldset>
  <row depends="$field3$">
    <panel>
      <table>
        <search id="test1">
          <query>|makeresults|eval test= "$form.field3$" |table test</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...