topic Set token in the value of another token? in Getting Data In

Set token in the value of another token?

C_Sparn — Wed, 04 Jun 2014 07:13:03 GMT

Hello,

I'm looking for a possibility to use one token $token2$ as part of the value of another token.
For example you have a dropdown input that is $token1$ and you want to set $token2$ as part of the value of one choice like this:

 <input type="dropdown" token="token1" searchWhenChanged="false">
  <label> any </label>
  <choice> value="field = $token2$">Test</choice>
</input>

If I now use $token1$ in my search string I just get the string "$token2$" and not the value of $token2$. Is there a possibility to get the value of $token2$ in the value of $token1$ in simple xml without using macros??
Thanks for help
Greetings

Re: Set token in the value of another token?

somesoni2 — Wed, 04 Jun 2014 13:54:55 GMT

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

Re: Set token in the value of another token?

bnorthway — Fri, 11 Dec 2015 19:16:46 GMT

you are a freaking genius!

Re: Set token in the value of another token?

bnorthway — Fri, 11 Dec 2015 19:52:07 GMT

do you know how to re-run the search for token1 when the value for token2 changes?

Re: Set token in the value of another token?

kamal_jagga — Wed, 17 Feb 2016 16:58:01 GMT

change value of searchWhenChanged to true. This will re-run search when value changes.