Dashboards & Visualizations

How do I perform a drilldown by checking multiple tokens in the same condition?

andrewtrobec
Motivator

Hello,

I have three tokens: token_1, token_2, and token_3. I'm trying to set the value of token_3 based on the values of token_1 and token_2, but I cannot for the life of me figure out the correct syntax in the drilldown tag. The conditions for setting token_3 are the following:

  1. token_1 must not be null
  2. token_2 must have value "OK"

The following XML does not create errors, but doesn't work either:

    <condition match="NOT isnull(token_1) &amp;&amp; token_2=&quot;OK&quot;">
        <set token="token_3">*</set>
    </condition>
</drilldown>

I've tried using $$ around the token names and replacing = with ==, but nothing works.

A push in the right direction would be greatly appreciated.

Thank you and best regards,

Andrew

0 Karma
1 Solution

mayurr98
Super Champion

Can you try ?

<drilldown>
        <condition match="isnotnull($token_1$) AND $token_2$=&quot;OK&quot;">
          <set token="token_3">*</set>
      </condition>
  </drilldown>

View solution in original post

mayurr98
Super Champion

Can you try ?

<drilldown>
        <condition match="isnotnull($token_1$) AND $token_2$=&quot;OK&quot;">
          <set token="token_3">*</set>
      </condition>
  </drilldown>

kd172906
Loves-to-Learn

How would you combine "match" and "label" into a single <condition>?  I've tried the following but keep getting syntax warnings in my Splunk dashboard editor:

<condition label="Test" , match="$myToken$ = 123">
<condition label="Test" and match="$myToken$ = 123">
<condition label="Test" &amp; match="$myToken$ = 123">

 

0 Karma

andrewtrobec
Motivator

@mayurr98 This works! I tried your original piece of code that didn't work, then realized that you had updated your comment with working code! I was very close, just a question of the right combination. Good to know! Thanks, very much appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...