Condition value NOT equal to....whatever

[dbcase]

Hi,

I have this XML code. What I'm trying to do is when the value = *, run a separate query and when the value is anything else but * run a different query. I'm having difficulty figuring out how to configure condition value to be not equal to *

 <input type="dropdown" token="mso_selection" searchWhenChanged="true">
      <label>Select a MSO</label>
      <search>
        <query>index=wholesale_app  sourcetype=wholesale_mobile_app buildTarget | dedup buildTarget</query>
        <earliest>-1d</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>buildTarget</fieldForLabel>
      <fieldForValue>buildTarget</fieldForValue>
      <choice value="*">- All -</choice>
      <default>*</default>
      <initialValue>*</initialValue>

      <change>
         <condition value="*">
           <set token="tokSearchQueryPanel1">index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |rex "\d+\s(?<mso>\w+)"|stats max(stat_val) as Subscribers by mso|stats sum(Subscribers) as count</set>
           <unset token="tokSearchQueryPanel2"></unset>
         </condition>

         <condition value"*">     (this line is what I'm trying to figure out)

           <set token="tokSearchQueryPanel2">index=mso_statistics sourcetype=ic_connectivity_5min-too_small  stat_name=subscribers |rex "\d+\s(?&lt;mso&gt;\w+)"|stats max(stat_val) as Subscribers by mso|where like(mso,"%$mso_selection$%") |stats sum(Subscribers) as count</set>
           <unset token="tokSearchQueryPanel1"></unset>
         </condition>
       </change>

    </input>

[woodcock]

Condition on label="All" instead.

[niketn · Accepted solution]

@dbcase, you can just use a condition block without any match expression. This servers as else condition.

      <condition value="*">
             <-- Your Code For Value Matching Asterix -->
      </condition>
      <condition>
             <--  Your Code For All Other Values not matching Asterix -->
      </condition>

Refer to one of my comments in my previous answer on similar question: https://answers.splunk.com/answers/596673/how-can-i-get-the-value-of-a-token-as-a-search-eva.html