I have the following xml code:
<change>
<condition value="default_value">
<unset token="some_token"></unset>
</condition>
</change>
I would like to unset some_token only when value DOESN'T equal "default_value".
I tried: condition value!="default_value" but it doesn't work and I get an error.
Thank you,
Samuel
try this
<change>
<condition match="fieldname!=default_value">
<unset token="some_token"></unset>
</condition>
</change>
Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens
try this
<change>
<condition match="fieldname!=default_value">
<unset token="some_token"></unset>
</condition>
</change>
Check below link,
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Viz/tokens
It seems to be the right direction.
I just don't understand what should be the fieldname.
Should it be $current_token$? or a field from the input's search query?
You need to use field from query. You haven't posted previous lines above change tag. So that i have mentioned as fieldname
Great, thanks!