Why is the "condition value" in the XML of my dashboard no longer working as expected after upgrading Splunk to 6.5.0?

[robertlynch2020]

The below used to work in previous version of SPLUNK before 6.5.
It is a drop-down that gets populated from a lookup.
I want to check if the user picks "Add new project" , however, now it is automatically picking it without the user interacting.

Has something changed in SPLUNK 6.5, as this has been working for multiple versions us to now?

    <label>Select which project this applies to</label>
    <search>
      <!-- Get a list of existing projects, plus two static values at the end: "Add new project", and "Remove from project" -->
      <query>| makeresults annotate=false count=1 | eval log_drop_name="$host_token$" | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | eval project = if(isnull(project),"",project) | inputlookup append=true PROJECT_GROUPINGS.csv | append [ | makeresults annotate=false count=1 | eval project="Remove from project" ] | append [ | makeresults annotate=false count=1 | eval project="Add new project" ] | table project | dedup project | head $projects_refresher$</query>
    </search>
    <fieldForLabel>project</fieldForLabel>
    <fieldForValue>project</fieldForValue>
    <selectFirstChoice>true</selectFirstChoice>
    <change>
      <condition value="Add new project">
        <set token="new_project_input">true</set>

        <unset token="form.new_project_input_text"></unset>

        <unset token="known_issues_project"></unset>
        <unset token="execute_add_known_issue"></unset>

        <unset token="execute_add_all_issues"></unset>
      </condition>
      <condition match="NOT value = 'Add new project'">
        <unset token="new_project_input"></unset>

        <eval token="known_issues_project">if('value'="",null,'value')</eval>

        <unset token="execute_add_known_issue"></unset>
        <unset token="execute_add_all_issues"></unset>
      </condition>
    </change>
  </input>

The query results are the following

| makeresults annotate=false count=1 | eval log_drop_name="$host_token$" | lookup PROJECT_GROUPINGS.csv log_drop_name OUTPUTNEW project | eval project = if(isnull(project),"",project) | inputlookup append=true PROJECT_GROUPINGS.csv | append [ | makeresults annotate=false count=1 | eval project="Remove from project" ] | append [ | makeresults annotate=false count=1 | eval project="Add new project" ] | table project | dedup project | head $projects_refresher$

NPC
Scotia-Errors
Add new project
Remove from project

SO "Add new project" is in the query, however, I need the end user to pick it before it drives other tokens.

All help is great as i have tried a few things...

[robertlynch2020]

This worked in the end - Thanks 🙂

 <condition match="value != &quot;Add new project&quot;">

I have no idea why my Orginal code stopped working, but this is doing the trick. Cheers 🙂

[harishalipaka]

hi am also searching for this type of problem please help for this .my question links are::

https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html

https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html

[niketn]

@robertlynch2020... Please upvote @nfilippi comment since his suggested code is what worked for you. Ideally you should have accepted his comment as answer!

[robertlynch2020]

I was trying to accept his comment, but i cant as its a commend on an answer.
SO i will upvote no worries, but how do i accept his answer ?

[robertlynch2020]

Unless he re-posts as an answer then i will accept perhaps ?
Im easy, he saved me a lot of work so i defo want to say thanks 🙂

[robertlynch2020]

for some reason i cant do more - > convert to answer!

[nfilippi_splunk · Accepted solution]

Have you tried something like this:

<condition match="value != &quot;Add new project&quot;">

[robertlynch2020]

Hi - Just getting to this NOW. Looks like this is it. Thanks very much

[harishalipaka]

hi am also searching for this type of problem please help for this .my question links are::

https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html

https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html

[woodcock]

If you create a run-anywhere example (using index=_*, getting rid of lookup and inputlookup, etc.), and post a complete XML, then I (and probably others) will try to help.

[harishalipaka]

hi am also searching for this type of problem please help for this .my question links are::

https://answers.splunk.com/answers/592116/related-to-tokens-in-multiselect.html

https://answers.splunk.com/answers/593597/developing-a-splunk-app-and-it-doesnt-work-on-mobi.html

[niketn]

Take out

<selectFirstChoice>true</selectFirstChoice>

[robertlynch2020]

Sorry but this does not work.

"new_project_input" is been set to true!

For some reason in the new SPLUNK 6.5 the value is set as "Add new Project", even do nothing has been picked? This worked in other version, so i am thinking of reporting it as a bug.

    <change>
      <condition value="Add new project">
        <set token="new_project_input">true</set>

[niketn]

Sorry @robertlynch2020 , you have accepted wrong answer. Please unaccept this and accept nfilippi's Answer.

[robertlynch2020]

Hi - I have done this now: FYI this option was not available to be 30 minutes ago. His answer has been moved into an answer and not a comment off an answer.

But its all fixed now, so cheers for your help 🙂

[rjthibod]

Or change it to "false" to make it explicit