- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible in the dashboard text fileld,
if i input positive number , such 3, the search will query result than > 3
if i input negative number, such as -3 the search will query result smaller than <-2
I can do it in 2 search, but if can do it in 1 query or 1 dashboard, it would be great
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

just made a few correction by replacing >
and <
by ">"
and "<"
and it works...
<form>
<label>math</label>
<fieldset submitButton="false">
<input type="text" token="field1">
<label>field1</label>
<change>
<condition match="'value' < "0"">
<set token="cond">| where value < </set>
<eval token="my_value">$value$+1</eval>
</condition>
<condition match="'value' > "0"">
<set token="cond">| where value></set>
<set token="my_value">$value$</set>
</condition>
<condition>
<set token="cond"></set>
<set token="my_value"></set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<title>$cond$ $my_value$</title>
<search>
<query>| makeresults | eval value="-3" | append [| makeresults | eval value="-2" ] | append [| makeresults | eval value="-1" ] | append [| makeresults | eval value="0" ] | append [| makeresults | eval value="2" ] | append [| makeresults | eval value="3" ] | append [| makeresults | eval value="4" ] $cond$ $my_value$ </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

just made a few correction by replacing >
and <
by ">"
and "<"
and it works...
<form>
<label>math</label>
<fieldset submitButton="false">
<input type="text" token="field1">
<label>field1</label>
<change>
<condition match="'value' < "0"">
<set token="cond">| where value < </set>
<eval token="my_value">$value$+1</eval>
</condition>
<condition match="'value' > "0"">
<set token="cond">| where value></set>
<set token="my_value">$value$</set>
</condition>
<condition>
<set token="cond"></set>
<set token="my_value"></set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<title>$cond$ $my_value$</title>
<search>
<query>| makeresults | eval value="-3" | append [| makeresults | eval value="-2" ] | append [| makeresults | eval value="-1" ] | append [| makeresults | eval value="0" ] | append [| makeresults | eval value="2" ] | append [| makeresults | eval value="3" ] | append [| makeresults | eval value="4" ] $cond$ $my_value$ </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks it worked on negative number but not positive number
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

already updated ...please check for +ve numbers
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks you you and @kamlesh_vaghela
i learn how to use conditional match.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

<condition match="'value' > "0"">
<set token="cond">| where value></set>
<set token="my_value">$value$</set>
</condition>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @kennethyeung,
I tried your requirement in below dashboard xml. Can you please try this? Take note I've used makeresults in search for sample events.
<form>
<label>Dashborad 1</label>
<fieldset submitButton="false">
<input type="text" token="field1">
<label>field1</label>
<change>
<condition match="'value' < "0"">
<set token="cond">| where value <</set>
<eval token="my_value">$value$+1</eval>
</condition>
<condition match="'value' > "0"">
<set token="cond">| where value></set>
<set token="my_value">$value$</set>
</condition>
<condition>
<set token="cond"></set>
<set token="my_value"></set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<title>$cond$ $my_value$</title>
<search>
<query>| makeresults | eval value="-3" | append [| makeresults | eval value="-2" ] | append [| makeresults | eval value="-1" ] | append [| makeresults | eval value="0" ] | append [| makeresults | eval value="2" ] | append [| makeresults | eval value="3" ] | append [| makeresults | eval value="4" ] $cond$ $my_value$ </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
Thanks
