How to unset an input token when value isn't the default

[vshakur]

I have the following xml code:

   <change>
        <condition value="default_value">
           <unset token="some_token"></unset>
        </condition>
   </change>

I would like to unset some_token only when value DOESN'T equal "default_value".
I tried: condition value!="default_value" but it doesn't work and I get an error.

Thank you,
Samuel

[sbbadri · Accepted solution]

try this

<change>
<condition match="fieldname!=default_value">
<unset token="some_token"></unset>
</condition>
</change>

Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens

[vshakur]

It seems to be the right direction.
I just don't understand what should be the fieldname.
Should it be $current_token$? or a field from the input's search query?

[sbbadri]

You need to use field from query. You haven't posted previous lines above change tag. So that i have mentioned as fieldname

[vshakur]

Great, thanks!