Hi All,
I am new to Splunk and am facing an issue with assigning token value based on condition. I'm using the following code:
<form stylesheet="custom_layout_overlay_icon_mod.css">
<label>Image Overlay with icons</label>
<search id="SOA_status">
<query>host="swaroops-MacBook-Pro.local" "Total Records processed"
| stats count</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<preview>
<!--No Data - Default Icon and Value-->
<condition match="'job.resultCount'==0">
<set token="SOA_status_icon">$redlight_mod1.png$</set>
<set token="SOA_status_value">0</set>
</condition>
<!--Else - Set Icon based on range and set value-->
<condition>
<eval token="SOA_status_icon">case($result.count$>=1 ,"$greenlight_mod1.png$")</eval>
<set token="SOA_status_value">$result.count$</set>
</condition>
</preview>
</search>
</style>
<div class="ingestion_pipeline">
<div class="image"/>
<!--
Environment Token $env:app$ available only Splunk Enterprise version 6.5 onwards.
In Previous versions App Name has to be hardcoded or fetched via Javascript i.e. autodiscover.js
-->
<img src="/static/app/BatchDashboard/images/Splunk.png"/>
<div class="singleValue" id="ST_upstream_status">$ST_upstream_value
<img src="/static/app/BatchDashboard/images/$ST_upstream_icon$"/>
</div>
My version of Splunk is 6.2.14, and yes, I did try after removing the $$ in greenlight_mod1.png as well. But the output I'm getting is $ST_upstream_value$ , and instead of image, it's showing as a ? mark in the blue box.
Looks like the lines after the condition match are not being executed.
Can someone please tell me what I'm doing that's causing this error? And, if its a problem of version, do you know how i can achieve this with version 6.2.14. ?
I would be really grateful, as I have been stuck for almost 3 weeks at this point.
Thanks in advance.
... View more