Dropdown input value to be passed to multiselect inputs

nawneel — Mon, 11 Jun 2018 11:04:35 GMT

Hi All,

I would like to pass a drop down filter value to multiselect value.
code for dropdown is as :

 <input type="dropdown" token="entity">
          <label>Entity</label>
          <choice value="*">All</choice>
          <choice value="_time">Time</choice>
          <choice value="_status">Status</choice>
        </input>

I would like to pass this to "Token value Suffix" of Multiselect filter.

<input type="multiselect" token="servers" searchWhenChanged="true">
        <label>Servers</label>
        <prefix>(</prefix>
        <valuePrefix>measurementIdentifier=ITSMServerLatency_</valuePrefix>
        <valueSuffix>-ping**$entity$**</valueSuffix>
        <delimiter> OR </delimiter>
        <fieldForLabel>Server</fieldForLabel>
        <fieldForValue>Server</fieldForValue>
        <search>
          <query>index="my_index" application=my_app Type=Network   (hostname=*) |rex field=Identifier  "ServerToITSMServerLatency_(?<Server>\w+)\-\w+\_(?<entity>\w+)"|dedup Identifier |stats count by Server</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <choice value="*">All</choice>
        <default>*</default>
        <suffix>)</suffix>
      </input>

My concern is that it runs good for the first time, but next time , token variable looses its identity and is replaced be first time or default value of $entity$.

Please let me know how can i maintain the token variable in multiselect?

Re: Dropdown input value to be passed to multiselect inputs

nawneel — Mon, 11 Jun 2018 14:52:48 GMT

Looks like its SPLUNK GUI BUG, When i tried saving this token using XML at backend, it worked!! It was having trouble through Splunk GUI.

topic Re: Dropdown input value to be passed to multiselect inputs in Getting Data In

Dropdown input value to be passed to multiselect inputs

Re: Dropdown input value to be passed to multiselect inputs