Splunk Search

Condition value NOT equal to....whatever

Motivator

Hi,

I have this XML code. What I'm trying to do is when the value = *, run a separate query and when the value is anything else but * run a different query. I'm having difficulty figuring out how to configure condition value to be not equal to *

 <input type="dropdown" token="mso_selection" searchWhenChanged="true">
      <label>Select a MSO</label>
      <search>
        <query>index=wholesale_app  sourcetype=wholesale_mobile_app buildTarget | dedup buildTarget</query>
        <earliest>-1d</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>buildTarget</fieldForLabel>
      <fieldForValue>buildTarget</fieldForValue>
      <choice value="*">- All -</choice>
      <default>*</default>
      <initialValue>*</initialValue>

      <change>
         <condition value="*">
           <set token="tokSearchQueryPanel1">index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |rex "\d+\s(?<mso>\w+)"|stats max(stat_val) as Subscribers by mso|stats sum(Subscribers) as count</set>
           <unset token="tokSearchQueryPanel2"></unset>
         </condition>

         <condition value"*">     (this line is what I'm trying to figure out)

           <set token="tokSearchQueryPanel2">index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |rex "\d+\s(?&lt;mso&gt;\w+)"|stats max(stat_val) as Subscribers by mso|where like(mso,"%$mso_selection$%") |stats sum(Subscribers) as count</set>
           <unset token="tokSearchQueryPanel1"></unset>
         </condition>
       </change>

    </input>
1 Solution

Legend

@dbcase, you can just use a condition block without any match expression. This servers as else condition.

      <condition value="*">
             <-- Your Code For Value Matching Asterix -->
      </condition>
      <condition>
             <--  Your Code For All Other Values not matching Asterix -->
      </condition>

Refer to one of my comments in my previous answer on similar question: https://answers.splunk.com/answers/596673/how-can-i-get-the-value-of-a-token-as-a-search-eva.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Esteemed Legend

Condition on label="All" instead.

0 Karma

Legend

@dbcase, you can just use a condition block without any match expression. This servers as else condition.

      <condition value="*">
             <-- Your Code For Value Matching Asterix -->
      </condition>
      <condition>
             <--  Your Code For All Other Values not matching Asterix -->
      </condition>

Refer to one of my comments in my previous answer on similar question: https://answers.splunk.com/answers/596673/how-can-i-get-the-value-of-a-token-as-a-search-eva.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!