Dashboards & Visualizations

How to set a condition match for a drop-down?

robertlynch2020
Motivator

Hi

I am looking to set a condition match for a drop-down, when a drop-down is selected the host_token is set [for the first time]. Then i want the condition match to pass and set the TPS_ON_ALL_PANELLS.

The issue is: do i set the condition match to a * or something else to pick up any value of when the token is set?

   <input type="dropdown" token="host_token" searchWhenChanged="true" rejects="$SHOW_HISTORICAL_ENVIRONMENTS$">
      <label>Data Source:</label>
      <search>
        <query>| metadata type=hosts index=mlc_live | fields host</query>
        <earliest>-1months</earliest>
        <latest>now</latest>
      </search>
      <default>-</default>    
      <change>

    <condition match="$host_token$ == &quot;*&quot;">
        <set token="TPS_ON_ALL_PANELLS">true</set>
      </condition>
      </change>
0 Karma

knielsen
Contributor

Maybe

<change>
  <eval token="TPS_ON_ALL_PANELS">if(value="*",true,false)</eval>
</change>

Lamar
Splunk Employee
Splunk Employee

You'll likely want to do something like this:

...
<change>
 <condition value="*">
   <set token="TPS_ON_ALL_PANELS">true</set>
</condition>
</change>
...
0 Karma

robertlynch2020
Motivator

In fact that does not work. It is like if the token has not been set it wont let it in.

0 Karma

lguinn2
Legend

What about <condition label="All">

0 Karma

briancronrath
Contributor

Is it not setting at all currently? Have you tried just the * character with out the escaped single quotes around it?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...