Splunk Search

Condition value NOT equal to....whatever

dbcase
Motivator

Hi,

I have this XML code. What I'm trying to do is when the value = *, run a separate query and when the value is anything else but * run a different query. I'm having difficulty figuring out how to configure condition value to be not equal to *

 <input type="dropdown" token="mso_selection" searchWhenChanged="true">
      <label>Select a MSO</label>
      <search>
        <query>index=wholesale_app  sourcetype=wholesale_mobile_app buildTarget | dedup buildTarget</query>
        <earliest>-1d</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>buildTarget</fieldForLabel>
      <fieldForValue>buildTarget</fieldForValue>
      <choice value="*">- All -</choice>
      <default>*</default>
      <initialValue>*</initialValue>

      <change>
         <condition value="*">
           <set token="tokSearchQueryPanel1">index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |rex "\d+\s(?<mso>\w+)"|stats max(stat_val) as Subscribers by mso|stats sum(Subscribers) as count</set>
           <unset token="tokSearchQueryPanel2"></unset>
         </condition>

         <condition value"*">     (this line is what I'm trying to figure out)

           <set token="tokSearchQueryPanel2">index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |rex "\d+\s(?&lt;mso&gt;\w+)"|stats max(stat_val) as Subscribers by mso|where like(mso,"%$mso_selection$%") |stats sum(Subscribers) as count</set>
           <unset token="tokSearchQueryPanel1"></unset>
         </condition>
       </change>

    </input>
1 Solution

niketn
Legend

@dbcase, you can just use a condition block without any match expression. This servers as else condition.

      <condition value="*">
             <-- Your Code For Value Matching Asterix -->
      </condition>
      <condition>
             <--  Your Code For All Other Values not matching Asterix -->
      </condition>

Refer to one of my comments in my previous answer on similar question: https://answers.splunk.com/answers/596673/how-can-i-get-the-value-of-a-token-as-a-search-eva.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

Condition on label="All" instead.

0 Karma

niketn
Legend

@dbcase, you can just use a condition block without any match expression. This servers as else condition.

      <condition value="*">
             <-- Your Code For Value Matching Asterix -->
      </condition>
      <condition>
             <--  Your Code For All Other Values not matching Asterix -->
      </condition>

Refer to one of my comments in my previous answer on similar question: https://answers.splunk.com/answers/596673/how-can-i-get-the-value-of-a-token-as-a-search-eva.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...