Splunk Search
Highlighted

How to unset an input token when value isn't the default

Path Finder

I have the following xml code:

   <change>
        <condition value="default_value">
           <unset token="some_token"></unset>
        </condition>
   </change>

I would like to unset some_token only when value DOESN'T equal "default_value".
I tried: condition value!="default_value" but it doesn't work and I get an error.

Thank you,
Samuel

0 Karma
Highlighted

Re: How to unset an input token when value isn't the default

Motivator

try this

<change>
<condition match="fieldname!=defaultvalue">
<unset token="some
token"></unset>
</condition>
</change>

Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens

View solution in original post

Highlighted

Re: How to unset an input token when value isn't the default

Path Finder

It seems to be the right direction.
I just don't understand what should be the fieldname.
Should it be $current_token$? or a field from the input's search query?

0 Karma
Highlighted

Re: How to unset an input token when value isn't the default

Motivator

You need to use field from query. You haven't posted previous lines above change tag. So that i have mentioned as fieldname

0 Karma
Highlighted

Re: How to unset an input token when value isn't the default

Path Finder

Great, thanks!

0 Karma