You need to use another search to (conditionally) set the result field to null and use the results tokens from the search. For example: {
"visualizations": {
"viz_F0Z9jsFU": {
...
See more...
You need to use another search to (conditionally) set the result field to null and use the results tokens from the search. For example: {
"visualizations": {
"viz_F0Z9jsFU": {
"type": "splunk.singlevalue",
"title": "Speed in km/h",
"dataSources": {
"primary": "ds_eZ6LtdAT"
},
"options": {
"unit": "km/h"
}
},
"viz_p4tcz9dd": {
"type": "splunk.singlevalue",
"dataSources": {
"primary": "ds_RopRdHUj"
},
"title": "Speed in mph",
"options": {
"unit": "mph"
},
"description": "$km per hour : result.kmh$ * 0.621"
}
},
"dataSources": {
"ds_eZ6LtdAT": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| eval kmh=random()%100",
"enableSmartSources": true
},
"name": "km per hour"
},
"ds_RopRdHUj": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| eval speed_in_mph = if($km per hour:result.kmh$ > 50, $km per hour:result.kmh$ * 0.621, null())\n| table speed_in_mph"
},
"name": "kmh to mph"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
}
},
"layout": {
"type": "absolute",
"options": {
"width": 1440,
"height": 960,
"display": "auto"
},
"structure": [
{
"item": "viz_F0Z9jsFU",
"type": "block",
"position": {
"x": 10,
"y": 10,
"w": 250,
"h": 250
}
},
{
"item": "viz_p4tcz9dd",
"type": "block",
"position": {
"x": 290,
"y": 10,
"w": 250,
"h": 250
}
}
],
"globalInputs": [
"input_global_trp"
]
},
"description": "",
"title": "Evaluate tokens using search"
} Adapted from documentation example here