topic Re: How to auto-fill/refresh a filter? in Getting Data In

How to auto-fill/refresh a filter?

andrehl — Tue, 07 Aug 2018 02:21:45 GMT

Hi Community!

I would like the filter named [Total Distinct Customer in 2017 //ignore and Total Distinct Customer in 2018 //ignore] ,as attached in the picture, to fill itself with the number in the single value panel without having the user to click on it.

Thanks before!

Re: How to auto-fill/refresh a filter?

renjith_nair — Tue, 07 Aug 2018 03:09:55 GMT

@andrehl ,

You could use a token (set once the search is done) to set the value.

E.g.

<form>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>sourcetype</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>|metadata type=sourcetypes|fields sourcetype</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="text" token="text">
      <label>Text</label>
      <!--Use the token which is set below as default vlaue of text box-->      
      <default>$mycount$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_* sourcetype=$sourcetype$|stats count</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <!--set the token value to the field name . Here its count-->
          <done>
            <set token="mycount">$result.count$</set>
          </done>
        </search>
        <option name="drilldown">none</option> 
      </single>
    </panel>
  </row>
</form>

Re: How to auto-fill/refresh a filter?

andrehl — Wed, 08 Aug 2018 01:32:35 GMT

my apology, I forgot to mention that my Time Range has to be an 'All Time'. Using your method, I can't seem to make it wait 'til the end of my search query.

Re: How to auto-fill/refresh a filter?

renjith_nair — Wed, 08 Aug 2018 02:09:11 GMT

actually it does not matter because unless your search is completed, you don't have complete data and also the single value is also incomplete. So as soon as your result is complete, the value is being automatically shown in text box as well. You could use progress also instead of done but as mentioned its not the final result

Re: How to auto-fill/refresh a filter?

andrehl — Wed, 08 Aug 2018 03:27:20 GMT

It worked like a charm! Thank you so much!
May I know where can I get all the XML references from?

Re: How to auto-fill/refresh a filter?

renjith_nair — Wed, 08 Aug 2018 04:59:39 GMT

Here you go - http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/tokens