topic Re: Is it possible to produce a dynamic search using token generated fields? in Dashboards & Visualizations

Is it possible to produce a dynamic search using token generated fields?

ryantodd — Tue, 29 Sep 2020 12:11:54 GMT

Hi there, is it possible to search using fields generated by token?

For example, I have a couple of fields:
1. roomtemp_apple_qty
2. chilled_apple_qty
3. roomtemp_orange_qty
4. chilled_orange_qty

I wish to be able to pass a $fruit$ token from my drop-down input in a dashboard and do something like this.

sourcetype=fruit_store | eval roomTempFieldName = "roomTemp" + $fruit$ + "_qty" | eval  chilledFieldName = "chilled_" $fruit$ + "_qty"| list avg(roomTempFieldName), avg(chilledFieldName)

Re: Is it possible to produce a dynamic search using token generated fields?

rjthibod — Mon, 26 Dec 2016 16:49:23 GMT

You can probably do what you ask in some way using the $value$ token in a dropdown (see http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Access_labels_and_values_of_form_inputs), but it may be more trouble than its worth. Instead, you can use the conditional elements to do it like the following.

<form>
  <fieldset submitButton="false">
    <input type="dropdown" token="fruittype">
      <label>Select a fruit type</label>
      <choice value="apple">Apples</choice>
      <choice value="orange">Oranges</choice>
      <change>
        <condition label="Apples">
          <set token="roomtemp_field">roomtemp_apple_qty</set>
          <set token="chilledtemp_field">chilled_apple_qty</set>
        </condition>
        <condition label="Oranges">
          <set token="roomtemp_field">roomtemp_orange_qty</set>
          <set token="chilledtemp_field">chilled_orange_qty</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
        <query>sourcetype=fruit_store | stats avg($roomtemp_field$) avg($chilledtemp_field$)</query>
        </search>
      </table>
    </panel>
  </row>
</form>

Re: Is it possible to produce a dynamic search using token generated fields?

somesoni2 — Mon, 26 Dec 2016 20:21:18 GMT

Did you try like this?

 sourcetype=fruit_store | list avg("roomTemp$fruit$_qty" ), avg("chilled_$fruit$_qty")

 sourcetype=fruit_store | eval roomTempFieldName = [| gentimes start=-1 | eval search="roomTemp" + $fruit$ + "_qty" | table search] | eval  chilledFieldName = [| gentimes start=-1 | eval search="chilled_" $fruit$ + "_qty" | table search] | list avg(roomTempFieldName), avg(chilledFieldName)