Splunk Search

Help putting a condition match for a search with three possible results to show/hide either both or one of two panels

jaffar20
Explorer

I'm trying to either hide or show two panels depending on a search result from a different panel which will have 3 options.

E.g. If the result is "A" I want both panels to show, If "B" then just one panel, and if "C" then just the other panel.

I don't want to use my actual search in case a google search leads to my companies product but I've done the condition that the other panel is dependant on like this:

<condition match="'Letter' == &quot;A&quot;">
  <set token="show_panel_1">true</set>
  <set token="show_panel_2">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>
</condition>
<condition match="'Letter' == &quot;B&quot;">
  <set token="show_panel_1">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>
</condition>
<condition match="'Letter' == &quot;C&quot;">
  <set token="panel_show_2">true</set>
</condition>
<condition>
  <unset token="show_panel_1"></unset>
  <unset token="show_panel_2"></unset>`

And the panels two panels are done as,

<panel depends="$show_panel_1$">

and

<panel depends="$show_panel_2$">

However, both panels are hidden regardless of the result. What did I do wrong? I've seen other examples online used the unset so that's why I used it, but even when I try removing it or just putting it at the end, it still doesn't work.

0 Karma
1 Solution

jaffar20
Explorer

Solved it: it was the field name being in quotes

View solution in original post

0 Karma

jaffar20
Explorer

Solved it: it was the field name being in quotes

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...