Dashboards & Visualizations

condition match tag in drill down condition based on form input token and drilldown value not working

k_harini
Communicator

I have set drilldown for pie chart based on a token and it is working.. Now my condition is to display different table based on form input token set and drill down click value.. How could i do that..
I have tried this so far. but its not working..

                  <condition match =  "'$Status$' == Imported to prod">
        <set token="src_type_tok_dev">$click.value$</set>
                 <set token="mytoken1">true</set>
                 <unset token="mytoken2"></unset>
             </condition>
         <condition match="'$Status$' != Imported to prod">
           <set token="src_type_tok_dev">$click.value$</set>
                 <set token="mytoken2">true</set>
                 <unset token="mytoken1"></unset>
             </condition>
    </drilldown>

and then i do .. something like this

table depends="$src_type_tok_dev$,$mytoken1$" ...

status here is set from form.. please help

Tags (1)

akarivaratharaj
Communicator

I am also facing the similar kind of issue. Below is the part of my code.

I am trying to make drill down in the same dashboard. From the panel1, I am taking the token input of click value as "feature" and passing to panel2.
In the condition part if my token $feature$ = "FileInspector", then I am setting a Query itself as a token called "querytocall". if the token $feature$ = "UMB", then setting other query to the same token "querytocall".

At last I am passing that token "querytocall" itself as a search query for the Panel2. But this is not working. My panel2 is showing as "waiting for the input"

       <drilldown>
      <set token="feature">$click.value$</set>
    </drilldown>
  </chart>
</panel>
<panel>
  <title>$feature$ - Exception From Hosts Details</title>
  <chart depends="$feature$">
    <change>
      <condition match=" $feature$ == &quot;FileInspector&quot; ">
        <set token="querytocall">index=a source=b | eval....</set>
      </condition>
      <condition match=" $feature$ == &quot;UMB&quot; ">
        <set token="querytocall">index=c source=d | eval....</set>
      </condition>
    </change>
    <search>
      <query>$querytocall$</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>

Could anyone please help me on this.

0 Karma

rjthibod
Champion

You need to use single quotes instead of dollar sign in the condition statement, and the string needs to be wrapped in HTML double quotes with &quot;.

Try this.

  <condition match="'Status'==&quot;Imported to prod&quot;">
    <set token="src_type_tok_dev">$click.value$</set>
     <set token="mytoken1">true</set>
     <unset token="mytoken2"/>
  </condition>
  <condition match="'Status'!=&quot;Imported to prod&quot;">
     <set token="src_type_tok_dev">$click.value$</set>
     <set token="mytoken2">true</set>
     <unset token="mytoken1"/>
  </condition>
</drilldown>

robertlynch2020
Motivator

Thanks , but no luck, i have tried both.

  <condition match="'$host_token$'!=&quot;UNDEFINED&quot;">
    or
     <condition match="$host_token$!=&quot;UNDEFINED&quot;">
0 Karma

rjthibod
Champion

Your first one shows single quotes and dollar sign. Just use single quotes if you have not.

Also, where is Status and host_token coming from? How are they set?

0 Karma

robertlynch2020
Motivator

Host_token is a token that i have set to UNDEFINED before it comes to this section.
So at the start i check if it is working and host_token=UNDEFINED.

(Ideally I don't want to set this token to UNDEFINED before we get here, however doing a check off an undefined token was also not working)

    <label>Data Source:</label>
    <search>
      <query>| metadata type=hosts index=mlc_live | fields host</query>
      <earliest>-1months</earliest>
      <latest>now</latest>
    </search>
    <fieldForLabel>host</fieldForLabel>
    <fieldForValue>host</fieldForValue>
    <default>UNDEFINED</default>
  <change>
       <!--condition match="NOT value = 'UNDEFINED'"-->
         <!--condition match="$host_token$ != UNDEFINED"-->
           <condition match="'host_token'!=&quot;UNDEFINED&quot;">
      <unset token="tps_saved_test"></unset>
      <unset token="save_tps_test_average"></unset>
      <unset token="execute_tps_save_test"></unset>
      <unset token="execute_add_known_issue"></unset>
      <unset token="execute_add_all_issues"></unset>
      <unset token="tps_gc_overlay"></unset>
      <unset token="form.tps_gc_overlay"></unset>
      <unset token="user_token"></unset>
      <unset token="form.user_token"></unset>
      <unset token="form.parser_profiler_source_token"></unset>
      <unset token="TPS_Class_token_dropdown"></unset>
      <unset token="form.TPS_Class_token_dropdown"></unset>
      <unset token="fullyQualifiedMethod_or_class_PIE"></unset>
      <unset token="LOG_DROP_OR_LIVE_VIEW"></unset>
      <!--unset token="TPS_Class_token"></unset-->
      <set token="TPS_Class_token">*</set>
      <set token="fullyQualifiedMethod_or_class">fullyQualifiedMethod</set>
      <set token="form.tps_span_token">bins=1000</set>
      <set token="form.Log_vs_Linear">log</set>
      <set token="form.save_tps_test_dev_optimization">-</set>
      <set token="form.save_tps_test_functional_optimization">-</set>
      <set token="form.save_tps_test_test_case">-</set>
      <set token="TPS_ON_ALL_PANELLS">true</set>
        </condition>
    </change>
  </input>
0 Karma

rjthibod
Champion

That doesn't work because you are trying to do something not really allowed inside of an input. You have to use the token value when you want to look at the new value of an input in a condition element belonging to that input.

Also note, it is a good idea to dedup the host field in your search.

<query>| metadata type=hosts index=mlc_live | stats count by host | fields host</query>

   <change>
    <condition match="'value'!=&quot;UNDEFINED&quot;">
       <unset token="tps_saved_test"></unset>
       <unset token="save_tps_test_average"></unset>
       <unset token="execute_tps_save_test"></unset>
       <unset token="execute_add_known_issue"></unset>
       <unset token="execute_add_all_issues"></unset>
       <unset token="tps_gc_overlay"></unset>
       <unset token="form.tps_gc_overlay"></unset>
       <unset token="user_token"></unset>
       <unset token="form.user_token"></unset>
       <unset token="form.parser_profiler_source_token"></unset>
       <unset token="TPS_Class_token_dropdown"></unset>
       <unset token="form.TPS_Class_token_dropdown"></unset>
       <unset token="fullyQualifiedMethod_or_class_PIE"></unset>
       <unset token="LOG_DROP_OR_LIVE_VIEW"></unset>
       <!--unset token="TPS_Class_token"></unset-->
       <set token="TPS_Class_token">*</set>
       <set token="fullyQualifiedMethod_or_class">fullyQualifiedMethod</set>
       <set token="form.tps_span_token">bins=1000</set>
       <set token="form.Log_vs_Linear">log</set>
       <set token="form.save_tps_test_dev_optimization">-</set>
       <set token="form.save_tps_test_functional_optimization">-</set>
       <set token="form.save_tps_test_test_case">-</set>
       <set token="TPS_ON_ALL_PANELLS">true</set>
    </condition>
  </change>
</input>

robertlynch2020
Motivator

Brill 🙂 That worked ...thanks sooo much

0 Karma

rjthibod
Champion

Great. Please accept my original answer so people can know what worked.

0 Karma

gokadroid
Motivator

A shot in the dark, but can you try to switch the ' from '$Status$' to the string being matched and see if it works. Something like:

<condition match =  " $Status$ == 'Imported to prod' ">
:
:
<condition match =  " $Status$ != 'Imported to prod' ">

Updating little more info based on comment below

Or try to unset the token conventional way

<unset token="mytoken2"/>
:
:
<unset token="mytoken1"/>
0 Karma

k_harini
Communicator

I tried that.. It did not work.. 😞

0 Karma

robertlynch2020
Motivator

I have the same issues, did you get an answer

 <condition match="$host_token$ != 'UNDEFINED'">
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi k_harini,
let me understand: do you want to perform a drilldown in the same dashboard or in a different one?
Because the method you said is to do a drilldown in the same dashboard not in a different one.
If you want to drilldown in a different dashboard you have to insert in your panel options the following lines

<drilldown>
   <link>your_dashboard?src_type_tok_dev=$click.value$</link>
</drilldown>

If you want you could add additional tokens e.g. Time.earliest and Time.latest adding

&amp;TimeFrom=$Time.earliest$&amp;TimeTo=$Time.latest$

Bye.
Giuseppe

0 Karma

k_harini
Communicator

This is in the same dashboard. Condition match is not working with condition match token.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Try something like this:

<progress>
   <set token="mytoken">$job.eventCount$</set>
</progress>
<cancelled>
    <unset token="mytoken"></unset>
</cancelled>

Bye.
Giuseppe

0 Karma

k_harini
Communicator

Can someone please help me with this?

0 Karma

k_harini
Communicator

Is this doable.. I don't see many examples for this..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...