Splunk Search

How to unset an input token when value isn't the default

vshakur
Path Finder

I have the following xml code:

   <change>
        <condition value="default_value">
           <unset token="some_token"></unset>
        </condition>
   </change>

I would like to unset some_token only when value DOESN'T equal "default_value".
I tried: condition value!="default_value" but it doesn't work and I get an error.

Thank you,
Samuel

0 Karma
1 Solution

sbbadri
Motivator

try this

<change>
<condition match="fieldname!=default_value">
<unset token="some_token"></unset>
</condition>
</change>

Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens

View solution in original post

sbbadri
Motivator

try this

<change>
<condition match="fieldname!=default_value">
<unset token="some_token"></unset>
</condition>
</change>

Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens

vshakur
Path Finder

It seems to be the right direction.
I just don't understand what should be the fieldname.
Should it be $current_token$? or a field from the input's search query?

0 Karma

sbbadri
Motivator

You need to use field from query. You haven't posted previous lines above change tag. So that i have mentioned as fieldname

0 Karma

vshakur
Path Finder

Great, thanks!

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...