topic run specific query depens on token value in Splunk Enterprise

run specific query depens on token value

spisiakmi — Thu, 25 Apr 2024 06:29:45 GMT

Hi,

on a dashboard I have a simple check box element: LastOne_tkn (token name). If the check box is enabled, the LastOne_tkn=TRUE. There is simple small table view, which shows some results. I would like to run query in that table view based on LastOne_tkn condition.

LastOne_tkn=TRUE (dedup activated)

index=machinedata
| dedup Attr1
| table Attr1, Attr2

LastOne_tkn=otherwise (dedup deactivated)

index=machinedata
| table Attr1, Attr2

Any idea, please?

Re: run specific query depens on token value

ITWhisperer — Thu, 25 Apr 2024 07:44:17 GMT

Rather than setting the value to true, set it to the line you want in your search

<input type="checkbox" token="LastOne_tkn"> <label>Dedup</label> <choice value="| dedup Attr1">Dedup</choice> <default></default> <initialValue></initialValue> </input>

Then use the token in your search

index=machinedata $LastOne_tkn$ | table Attr1, Attr2

Re: run specific query depens on token value

spisiakmi — Thu, 25 Apr 2024 08:08:11 GMT

Hi ITWhisperer,

exactly this very simple elegant solution I needed. Thank you very much. Works fine.