below given is search query and I want to run this query only if token "$Check_Status$" is set to some value. if token "$Check_Status$" is unset then this query should not be run.
Query 1: Can we add condition to this search query? ( example: run if $Check_Status$=LIVE )
Query 2: Can we add multiple condition match something like ( condition match="'job.resultCount'>0" && "$token_xyz$==LIVE")
<search>
<query>eventtype=abc sourcetype=vmstat host=$host_name$ | stats earliest(_time) as earliest, latest(_time) as latest</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<finalized>
<condition match="'job.resultCount'>0">
<set token="vmstat_earliest_token">$result.earliest$</set>
<set token="vmstat_latest_token">$result.latest$</set>
</condition>
<condition match="'job.resultCount'==0">
<unset token="vmstat_earliest_token"></unset>
<unset token="vmstat_latest_token"></unset>
</condition>
</finalized>
</search>
You can set a new token based on an existing token like this: <eval token="conditionMATCH">if(($job.resultCount'>0" AND "$token_xyz$==LIVE"), "YES", null()</eval>
. You can use depends
to hide/execute an entire panel (and the search inside it) based on whether a token is set.
@agoyal... how are you setting Check_Status? Is that through check box or radio button? You can set your entire search string in change event.
Check_Status is set through drill down in a table content.
<table id="table1">
<search>
<query> Query </query>
<earliest>-150d@d</earliest>
<latest>now</latest>`enter code here`
</search>
<drilldown>
<set token="Check_Status">LOG_DROP</set>
</drilldown>
<option name="count">9</option>
<option name="drilldown">cell</option>
</table>