How to replace query input variables with variable values

ayushipaul — Thu, 29 Feb 2024 09:58:04 GMT

</input>
<input type="dropdown" token="project">
<label>Project</label>
<choice value="tok1*">Token1</choice>
<choice value="tok2*">Token2</choice>
<default>tok1</default>
<initialValue>tok1</initialValue>
<change>
<condition value="tok1">
<set token="x-key">key1-</set>
</condition>
<condition value="tok2">
<set token="x-key">key2-</set>
</condition>
</change>
</input>

<input type="multiselect" token="minorstate">
<label>minorstate</label>
<choice value="*">All</choice>
<choice value=""a", "b", "c", "d",">Minorstate</choice>
<default>"""a"", ""b"", ""c"", ""d""</default>
<prefix>(</prefix>
<suffix>)</suffix>
<initialValue>a,"b","c","d"</initialValue>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> , </delimiter>
<fieldForLabel>minorstate</fieldForLabel>
<fieldForValue>minorstate</fieldForValue>
<search>
<query>index=dunamis* sourcetype=dunamis_* producer=dunamis project=$project$ "x-key=$x-key$" | stats count by minorstate</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>

The variables $project$ and $x-key$ are not getting replaced by the values that are being set in the dropdown. Can someone please help? Thank you!

Re: How to replace query input variables with variable values

renjith_nair — Sat, 02 Mar 2024 03:43:56 GMT

Can you try changing the condition value to tok1* instead of tok1 ?

Here is a run anywhere example for reference

<form version="1.1" theme="light"> <label>Tokens</label> <fieldset submitButton="false"> <input type="dropdown" token="project" searchWhenChanged="true"> <label>Project</label> <choice value="tok1*">Token1</choice> <choice value="tok2*">Token2</choice> <change> <condition value="tok1*"> <set token="x-key">Key1</set> </condition> <condition value="tok2*"> <set token="x-key">Key2</set> </condition> </change> </input> <input type="multiselect" token="Record"> <label>Record</label> <delimiter> ,</delimiter> <fieldForLabel>Record</fieldForLabel> <fieldForValue>Record</fieldForValue> <search> <query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|search project=$project$ AND x-key=$x-key$</query> </search> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> </input> </fieldset> <row> <panel> <title>Project = $project$ , Key = $x-key$, Record = $Record$</title> <table> <title>Results</title> <search> <query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|where Record in ($Record$)</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form>

topic Re: How to replace query input variables with variable values in Splunk Dev

How to replace query input variables with variable values

Re: How to replace query input variables with variable values