<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Tokens based on Tags in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230702#M14306</link>
    <description>&lt;PRE&gt;&lt;CODE&gt; &amp;lt;fieldForLabel&amp;gt;tag&amp;lt;/fieldForLabel&amp;gt;
   &amp;lt;fieldForValue&amp;gt;node_primary_node_group_id&amp;lt;/fieldForValue&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Tue, 04 Oct 2016 20:29:00 GMT</pubDate>
    <dc:creator>dperry</dc:creator>
    <dc:date>2016-10-04T20:29:00Z</dc:date>
    <item>
      <title>Tokens based on Tags</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230698#M14302</link>
      <description>&lt;P&gt;I have a field value pair of the following:&lt;/P&gt;

&lt;P&gt;node_primary_node_group_id=3&lt;BR /&gt;
node_primary_node_group_id=4&lt;BR /&gt;
node_primary_node_group_id=5&lt;BR /&gt;
and so on....&lt;/P&gt;

&lt;P&gt;I created a tag for these values. ex:&lt;BR /&gt;
node_primary_node_group_id=3 (Web Servers)&lt;BR /&gt;
node_primary_node_group_id=5 (App Servers)&lt;BR /&gt;
node_primary_node_group_id=5 (DB Servers)&lt;/P&gt;

&lt;P&gt;I want to create a token that would let the user see  Dropdown Form Input Element with the tags I created - Web, App, and DB Server.&lt;/P&gt;

&lt;P&gt;I think I understand the basixc syntax for a DropDown Form Input Element but not sure how to use tags. This is possible?&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 11:16:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230698#M14302</guid>
      <dc:creator>dperry</dc:creator>
      <dc:date>2020-09-29T11:16:59Z</dc:date>
    </item>
    <item>
      <title>Re: Tokens based on Tags</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230699#M14303</link>
      <description>&lt;P&gt;You may not need tags for this purpose.  You can create a drop-down that is dynamically populated. Like this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;input type="dropdown" token="tokTag"&amp;gt;
&amp;lt;search&amp;gt;
&amp;lt;query&amp;gt;index=xyz earliest=-1d@d | stats count by node_primary_node_group_id | eval tag=case(node_primary_node_group_id=1, "Web Servers", node_primary_node_group_id=2, "App Servers", node_primary_node_group_id=3, "DB Servers", 1=1, "UNK") | fields node_primary_node_group_id tag&amp;lt;/query&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;tag&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;node_primary_node_group_id&amp;lt;/fieldForValue&amp;gt;
&amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;In the query for your dependent panel, use the tokTag, as the user selected value to filter your data. Like this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;search&amp;gt;
&amp;lt;query&amp;gt;index=xyz node_primary_node_group_id=$tokTag$" | ...&amp;lt;/query&amp;gt;
&amp;lt;/search&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 04 Oct 2016 19:45:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230699#M14303</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-10-04T19:45:09Z</dc:date>
    </item>
    <item>
      <title>Re: Tokens based on Tags</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230700#M14304</link>
      <description>&lt;P&gt;Thanks this is exactly what I was looking for !&lt;/P&gt;</description>
      <pubDate>Tue, 04 Oct 2016 19:47:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230700#M14304</guid>
      <dc:creator>dperry</dc:creator>
      <dc:date>2016-10-04T19:47:10Z</dc:date>
    </item>
    <item>
      <title>Re: Tokens based on Tags</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230701#M14305</link>
      <description>&lt;P&gt;I'm getting an error parsing XML......for the last &lt;/P&gt;</description>
      <pubDate>Tue, 04 Oct 2016 20:27:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230701#M14305</guid>
      <dc:creator>dperry</dc:creator>
      <dc:date>2016-10-04T20:27:56Z</dc:date>
    </item>
    <item>
      <title>Re: Tokens based on Tags</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230702#M14306</link>
      <description>&lt;PRE&gt;&lt;CODE&gt; &amp;lt;fieldForLabel&amp;gt;tag&amp;lt;/fieldForLabel&amp;gt;
   &amp;lt;fieldForValue&amp;gt;node_primary_node_group_id&amp;lt;/fieldForValue&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 04 Oct 2016 20:29:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230702#M14306</guid>
      <dc:creator>dperry</dc:creator>
      <dc:date>2016-10-04T20:29:00Z</dc:date>
    </item>
    <item>
      <title>Re: Tokens based on Tags</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230703#M14307</link>
      <description>&lt;P&gt;Sorry for the confusion....typo. This works!&lt;/P&gt;</description>
      <pubDate>Tue, 04 Oct 2016 20:43:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Tokens-based-on-Tags/m-p/230703#M14307</guid>
      <dc:creator>dperry</dc:creator>
      <dc:date>2016-10-04T20:43:50Z</dc:date>
    </item>
  </channel>
</rss>

