can if , then only be used inside of a search string (w/eval)

[ringbbg]

can [if , then ] only be used inside of a search string (w/eval) ?
im asking coz i have a dual drop down setup. The first dropdown has 4 options.
While the second dropdown only has 1 value, w/c will display as "ALL".
HOwever, the value of this "ALL" will depend on the choice in the first dropdown.

[lguinn2]

In your XML, you can set tokens that would redefine the meaning of "ALL" based on the other choices. But there might be an even easier way to do what you want. As @DalJeanis suggested, it would be helpful to see more about what you want to do. I would like to see the field set part of your XML, plus the searches you want to run, and a description of the variants.

But if you want to figure it out for yourself, then I recommend these resources:

1. In the Dashboards and Visualizations manual, there is a section on Token Usage in Dashboards. I believe this covers what you are trying to do.
2. I find the manual a bit abstract, although it does have examples. So I also recommend that you install the Splunk 6.x Dashboard Examples app.

[DalJeanis]

The context is unclear. If you post a chunk of code of what you are trying to do, and how you have it now, then we might be sable to get you closer.