Hello,
I have three tokens: token_1
, token_2
, and token_3
. I'm trying to set the value of token_3
based on the values of token_1
and token_2
, but I cannot for the life of me figure out the correct syntax in the drilldown tag. The conditions for setting token_3
are the following:
token_1
must not be nulltoken_2
must have value "OK"The following XML does not create errors, but doesn't work either:
<condition match="NOT isnull(token_1) && token_2="OK""> <set token="token_3">*</set> </condition> </drilldown>
I've tried using
$$
around the token names and replacing=
with==
, but nothing works.
A push in the right direction would be greatly appreciated.
Thank you and best regards,
Andrew
Can you try ?
<drilldown>
<condition match="isnotnull($token_1$) AND $token_2$="OK"">
<set token="token_3">*</set>
</condition>
</drilldown>
Can you try ?
<drilldown>
<condition match="isnotnull($token_1$) AND $token_2$="OK"">
<set token="token_3">*</set>
</condition>
</drilldown>
How would you combine "match" and "label" into a single <condition>? I've tried the following but keep getting syntax warnings in my Splunk dashboard editor:
<condition label="Test" , match="$myToken$ = 123">
<condition label="Test" and match="$myToken$ = 123">
<condition label="Test" & match="$myToken$ = 123">
@mayurr98 This works! I tried your original piece of code that didn't work, then realized that you had updated your comment with working code! I was very close, just a question of the right combination. Good to know! Thanks, very much appreciated.