Installation

If statement with * as token value not working and leads to incorrect comparison

k_harini
Communicator

Passing status token to if statement

eval start = strptime('Requested Start', "%d.%m.%Y")|eval end = strptime('Last changed On', "%d.%m.%Y")|eval completed_duration = round((end -start)/86400) |eval other_duration = round((now()-start)/86400)|eval duration_days = if("$Status$" == "Imported Prod" OR "$Status$" == "Withdrawn",completed_duration,other_duration) | table ID,Description,Status,duration_days |fieldformat duration_days = tostring(duration_days) + " Days"

Problem is when if status is passed as * it creates problem and comparison is not correct.. How to solve this? please help?

Tags (1)
0 Karma
1 Solution

k_harini
Communicator

Added the comparison as calculated field and used in dashboard. It worked. Thanks all for your inputs

View solution in original post

0 Karma

k_harini
Communicator

Added the comparison as calculated field and used in dashboard. It worked. Thanks all for your inputs

0 Karma

niketn
Legend

Are you sure issue is due to asterix and not due to if condition? Try replacing with case statement and add "$Status$" == "*",<somevaluetotest> just to test whether * is being handled. Ideally, there should be no issues with *, Since * = All is a very common value for form Inputs.

| eval duration_days = case("$Status$" == "Imported Prod" OR "$Status$" == "Withdrawn",completed_duration,1==1,other_duration) |

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

k_harini
Communicator

its not due to if condition.. actually when page is loaded status is passed as * as its a hidden field and then later value gets allocated based on chart click.. once value is allocated it behaves as per the condition in query.. when status value is all, it doesn't use comparison condition, i don't get error.. it uses other duration for everything even for imported prod and withdrawn.. so i get incorrect values for imported prod and withdrawn in that case.

0 Karma

niketn
Legend

What action do you want to perform when Status= All ()?\
You can set some default value for that like:
*
"$Status$" == "",other_duration*

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

k_harini
Communicator

Status *, when i display the tickets in table it takes the individual status values for all.. Ideally for all statuses I want to do the comparison and display the duration accordingly.. No separate condition for all.. I guess this is not correct way to achieve what i want.. I did with calculated field and it worked.. Thanks a lot for your response.

0 Karma

niketn
Legend

Glad that Calculated fields worked for you. Requesting you to add your approach as an Answer and accept the same. This way others facing similar issue/scenario will be benefited.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Token_filters

try adding |n into the token. $Status|n$It doesn't escape special characters. I'm not sure if it'll work, but it might.

0 Karma

k_harini
Communicator

Token|n is not working for me. I tried on that query where i don't need the default * value. I did a work around of making it as calculated field and used it in the dashboard.. Thanks a lot for your response

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...