Okay, I have found out what I want to achieve by using case statement. I have a further question, does having a line break cause difference in xml/splunk execution. For example,
<eval token="testToken">case($var1$="Apple" AND $var2$="(producttype=fruit)", "Fruit: Apple", (($var1$="Banana") AND ($var2$="(producttype=fruit)")), "Fruit: Banana")</eval>
The above works fine. I can access the testToken in the title field and it dynamically gets the value. However, when I want to make a line between conditions, for example:
<eval token="testToken">case($var1$="Apple" AND $var2$="(producttype=fruit)", "Fruit: Apple",
//LINE BREAK
(($var1$="Banana") AND ($var2$="(producttype=fruit)")), "Fruit: Banana")</eval>
I am unable to access testToken in title, it just shows in the title as $testToken$.
Do you know about this?
... View more