Splunk Search

How to unset an input token when value isn't the default

vshakur
Path Finder

I have the following xml code:

   <change>
        <condition value="default_value">
           <unset token="some_token"></unset>
        </condition>
   </change>

I would like to unset some_token only when value DOESN'T equal "default_value".
I tried: condition value!="default_value" but it doesn't work and I get an error.

Thank you,
Samuel

0 Karma
1 Solution

sbbadri
Motivator

try this

<change>
<condition match="fieldname!=default_value">
<unset token="some_token"></unset>
</condition>
</change>

Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens

View solution in original post

sbbadri
Motivator

try this

<change>
<condition match="fieldname!=default_value">
<unset token="some_token"></unset>
</condition>
</change>

Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens

vshakur
Path Finder

It seems to be the right direction.
I just don't understand what should be the fieldname.
Should it be $current_token$? or a field from the input's search query?

0 Karma

sbbadri
Motivator

You need to use field from query. You haven't posted previous lines above change tag. So that i have mentioned as fieldname

0 Karma

vshakur
Path Finder

Great, thanks!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...