Dashboards & Visualizations

How to take a token value and use it in a conditional statement within a panel?

SLoBello
Explorer

What I have set up:

$panel_2$ is a token with a Boolean value inside the main panel.
$panel_3$ is a token with a Boolean value inside panel 2
(I also have other tokens in each panel that set values to the clicked field, such as $_sourcetype$)

Main Panel has data. User clicks the sourcetype (the row/column of interest) to access more details.
$panel_2$ has been set to true and that panel is visible. User wants more details and clicks a field of interest.
$panel_3$ has been set to true and that panel is visible.

These work fine without issues when the sourcetypes have similar fields for the query
(i.e. WinEventLog:Security & WinEventLog:Application work fine obviously)

THE ISSUE: I want to change between two or three queries depending on the sourcetype selected.
(checking whether it doesn't produce results would be a plus)

"syslog" for example does not work with the query in panel 2.

I want to check the token $_sourcetype$ to "syslog" and use a query that would provide me results.

panel 2
...bla bla...
-----search
--------if ($_sourcetype$ == syslog)
--------------query>use this query
--------else ()
--------------query>use this one
-----/search
...bla bla...
/panel

I know this can be done using condition match and switching between another panel. But I want to keep this within the same panel

1 Solution

tiagofbmm
Influencer

If you want to maintain that so much in the same panel, you can create a tokens that contains the one search query. In case your condition matches, you change that token to the other search you want to be run

View solution in original post

0 Karma

tiagofbmm
Influencer

If you want to maintain that so much in the same panel, you can create a tokens that contains the one search query. In case your condition matches, you change that token to the other search you want to be run

0 Karma

SLoBello
Explorer

I didn't even think of that. Awesome, thank you!

0 Karma

rey123
Path Finder

@tiagofbmm, could you please share the source xml of the working solution, if possible? That way, those of trying to achieve the same thing could understand the syntax and 'how to', better. Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...