Re: Can someone help me get my token working?

marvinlee93 · ‎12-14-2018

Hi all,

I have a table that will calculate the redalert and blackalert status through the EVAL command. (1 = ON, 0 = OFF)

I have used the command to on/off a panel that will display a static HTML image.

The table is showing the correct results but my panels are not showing/changing even though the status of the redalert and blackalert has been changed. Any idea why? Below is my code.

   <row>
     <panel>
        <table>
         <search id="search_logic">
           <query>index="main"  
          | eval WBGT=0.7*(Humidity__RH)/(100)*(Temperature_degC) + 4.4 + 0.2*(Temperature_degC)
          | eval red_increase=if(WBGT>32 AND WBGT<33,1,0)
          | streamstats window=10 sum(red_increase) as redincreases
          | eval redalert=if(redincreases>=10,1,0) 

          | eval black_increase=if(WBGT>32.9,1,0)
          | streamstats window=10 sum(black_increase) as blackincreases
          | eval blackalert=if(blackincreases>=10,1,0)
          |table WBGT blackalert redalert |tail 10

          </query>
          <earliest>rt</earliest>
          <latest>rt</latest>
          <refresh>1s</refresh>
          <refreshType>delay</refreshType>

          <progress>
             <!--set the tokens based on the value of red and black alert -->
             <condition match="$result.redalert$ == 0 AND $result.blackalert$ == 0">
               <set token="Greencaution">true</set>
               <unset token="Redcaution"></unset>
               <unset token="Blackcaution"></unset>
             </condition> 
             <condition match="$result.redalert$ == 1">
               <set token="Redcaution">true</set>
               <unset token="Blackcaution"></unset>
               <unset token="Greencaution"></unset>
             </condition>
             <condition match="$result.blackalert$ == 1">
               <set token="Redcaution"></set>
               <unset token="Blackcaution">true</unset>
               <unset token="Greencaution"></unset>
             </condition>  
           </progress>
         </search>
         <!-- This is a dummy search to extract COUNT -->
         <option name="drilldown">none</option>
        </table>
     </panel>
   </row>
   <row>
     <panel depends="$Redcaution$">
     <html>
       <h1>Red caution</h1>
         <p style="text-align:center;">
           <img hspace="5" alt="Logo" src="/static/app/search/images/Red.jpg" />
         </p>
     </html> 
     </panel>
   </row>
   <row>
     <panel depends="$Greencaution$">
     <html>
       <h1>Green caution</h1>
         <p style="text-align:center;">
           <img hspace="5" alt="Logo" src="/static/app/search/images/Green.jpg" />
         </p>
     </html> 
     </panel>
   </row>
   <row>
     <panel depends="$Blackcaution$">
     <html>
       <h1>Black caution</h1>
         <p style="text-align:center;">
           <img hspace="5" alt="Logo" src="/static/app/search/images/Black.jpg" />
         </p>
     </html> 
     </panel>
   </row>

whrg · ‎12-14-2018

This looks wrong (lines 35+36):

<set token="Redcaution"></set>
<unset token="Blackcaution">true</unset>

marvinlee93 · ‎12-16-2018

Hi, Yup. I changed it. But it's still not working..

sdchakraborty · ‎12-14-2018

instead of progress tag can u set-unset those tokens under done tag and see,

    <done>
          <!--set the tokens based on the value of red and black alert -->
          <condition match="$result.redalert$ == 0 AND $result.blackalert$ == 0">
            <set token="Greencaution">true</set>
            <unset token="Redcaution"></unset>
            <unset token="Blackcaution"></unset>
          </condition> 
          <condition match="$result.redalert$ == 1">
            <set token="Redcaution">true</set>
            <unset token="Blackcaution"></unset>
            <unset token="Greencaution"></unset>
          </condition>
          <condition match="$result.blackalert$ == 1">
            <set token="Redcaution"></set>
            <unset token="Blackcaution">true</unset>
            <unset token="Greencaution"></unset>
          </condition>  
        </done>

marvinlee93 · ‎12-16-2018

Yup. I've tried this. But it is still not working.

Can someone help me get my token working?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation