<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Using a token in a search in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315892#M20289</link>
    <description>&lt;P&gt;Is it the issue due to &lt;CODE&gt;&amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;&lt;/CODE&gt; ?&lt;/P&gt;</description>
    <pubDate>Thu, 30 Nov 2017 16:03:47 GMT</pubDate>
    <dc:creator>kamlesh_vaghela</dc:creator>
    <dc:date>2017-11-30T16:03:47Z</dc:date>
    <item>
      <title>Using a token in a search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315886#M20283</link>
      <description>&lt;P&gt;Hi I have this XML code&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;input type="dropdown" token="mso_selection"&amp;gt;
      &amp;lt;label&amp;gt;Select a MSO&amp;lt;/label&amp;gt;
      &amp;lt;search&amp;gt;
        &amp;lt;query&amp;gt;index=wholesale_app  sourcetype=wholesale_mobile_app | spath buildTarget  | dedup buildTarget&amp;lt;/query&amp;gt;
        &amp;lt;earliest&amp;gt;-1d&amp;lt;/earliest&amp;gt;
        &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;buildTarget&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;buildTarget&amp;lt;/fieldForValue&amp;gt;
    &amp;lt;/input&amp;gt;

 &amp;lt;input type="radio" token="Product_token"&amp;gt;
        &amp;lt;label&amp;gt;Select a Product&amp;lt;/label&amp;gt;
       &amp;lt;choice value="All"&amp;gt;All&amp;lt;/choice&amp;gt;
       &amp;lt;choice value="Converge"&amp;gt;Converge&amp;lt;/choice&amp;gt;
       &amp;lt;choice value="Touchstone"&amp;gt;Touchstone&amp;lt;/choice&amp;gt;
       &amp;lt;default&amp;gt;All&amp;lt;/default&amp;gt;
       &amp;lt;change&amp;gt;
         &amp;lt;condition value="All"&amp;gt;
           &amp;lt;set token="productsearchquery"&amp;gt;[search index=wholesale_app buildTarget=$mso_selection$ analyticType=Checkpoint     Properties.index=39 OR Properties.index=40|dedup clientSessionId|table clientSessionId]&amp;lt;/set&amp;gt;
           &amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;
         &amp;lt;/condition&amp;gt;
         &amp;lt;condition value="Converge"&amp;gt;
           &amp;lt;set token="productsearchquery"&amp;gt;[search index=wholesale_app buildTarget=$mso_selection$ analyticType=Checkpoint     Properties.index=39|dedup clientSessionId|table clientSessionId]&amp;lt;/set&amp;gt;
          &amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition value="Touchstone"&amp;gt;
           &amp;lt;set token="productsearchquery"&amp;gt;[search index=wholesale_app buildTarget=$mso_selection$ analyticType=Checkpoint     Properties.index=40|dedup clientSessionId|table clientSessionId]&amp;lt;/set&amp;gt;
          &amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;/condition&amp;gt;


       &amp;lt;/change&amp;gt;
     &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And then I have this query&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;query&amp;gt;index=wholesale_app buildTarget=$mso_selection$ analyticType=SessionStart $productsearchquery$   |lookup phone_models_edited.csv Model AS Properties.platformData.HM
 | stats count  by   Display_model | rename  Display_model as "Phone Model" count as Count|sort -Count&amp;lt;/query&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And the panel on the dashboard sits there saying waiting for input even after everything is selected.  Where am I going wrong?&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2017 15:41:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315886#M20283</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-11-30T15:41:50Z</dc:date>
    </item>
    <item>
      <title>Re: Using a token in a search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315887#M20284</link>
      <description>&lt;P&gt;a bit more information....  if I remove $productsearchquery$ the panel works.  So the problem is setting that token somehow but I can't seem to figure out why its not being set....&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2017 15:53:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315887#M20284</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-11-30T15:53:17Z</dc:date>
    </item>
    <item>
      <title>Re: Using a token in a search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315888#M20285</link>
      <description>&lt;P&gt;HI @dbcase,&lt;/P&gt;

&lt;P&gt;You are setting &lt;CODE&gt;productsearchquery&lt;/CODE&gt; in all three condition and very next unsetting the same token. Is it right?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;condition value="All"&amp;gt;
            &amp;lt;set token="productsearchquery"&amp;gt;[search index=wholesale_app buildTarget=$mso_selection$ analyticType=Checkpoint     Properties.index=39 OR Properties.index=40|dedup clientSessionId|table clientSessionId]&amp;lt;/set&amp;gt;
            &amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;/condition&amp;gt;
          &amp;lt;condition value="Converge"&amp;gt;
            &amp;lt;set token="productsearchquery"&amp;gt;[search index=wholesale_app buildTarget=$mso_selection$ analyticType=Checkpoint     Properties.index=39|dedup clientSessionId|table clientSessionId]&amp;lt;/set&amp;gt;
           &amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;
           &amp;lt;/condition&amp;gt;
           &amp;lt;condition value="Touchstone"&amp;gt;
            &amp;lt;set token="productsearchquery"&amp;gt;[search index=wholesale_app buildTarget=$mso_selection$ analyticType=Checkpoint     Properties.index=40|dedup clientSessionId|table clientSessionId]&amp;lt;/set&amp;gt;
           &amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;
           &amp;lt;/condition&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Bcoz, same token &lt;CODE&gt;productsearchquery&lt;/CODE&gt; you are using in search query.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;query&amp;gt;index=wholesale_app buildTarget=$mso_selection$ analyticType=SessionStart $productsearchquery$    |lookup phone_models_edited.csv Model AS Properties.platformData.HM
  | stats count  by   Display_model | rename  Display_model as "Phone Model" count as Count|sort -Count&amp;lt;/query&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2017 15:55:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315888#M20285</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2017-11-30T15:55:12Z</dc:date>
    </item>
    <item>
      <title>Re: Using a token in a search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315889#M20286</link>
      <description>&lt;P&gt;What is the point of &lt;CODE&gt;&amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;&lt;/CODE&gt; after each &lt;CODE&gt;&amp;lt;set&amp;gt;&lt;/CODE&gt;?&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2017 15:55:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315889#M20286</guid>
      <dc:creator>micahkemp</dc:creator>
      <dc:date>2017-11-30T15:55:51Z</dc:date>
    </item>
    <item>
      <title>Re: Using a token in a search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315890#M20287</link>
      <description>&lt;P&gt;Found it......&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2017 16:00:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315890#M20287</guid>
      <dc:creator>dbcase</dc:creator>
      <dc:date>2017-11-30T16:00:17Z</dc:date>
    </item>
    <item>
      <title>Re: Using a token in a search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315891#M20288</link>
      <description>&lt;P&gt;Do you mind posting the solution you found?&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2017 16:03:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315891#M20288</guid>
      <dc:creator>micahkemp</dc:creator>
      <dc:date>2017-11-30T16:03:10Z</dc:date>
    </item>
    <item>
      <title>Re: Using a token in a search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315892#M20289</link>
      <description>&lt;P&gt;Is it the issue due to &lt;CODE&gt;&amp;lt;unset token="productsearchquery"&amp;gt;&amp;lt;/unset&amp;gt;&lt;/CODE&gt; ?&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2017 16:03:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315892#M20289</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2017-11-30T16:03:47Z</dc:date>
    </item>
    <item>
      <title>Re: Using a token in a search</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315893#M20290</link>
      <description>&lt;P&gt;Yes, I would like to know the answer too.&lt;/P&gt;</description>
      <pubDate>Thu, 28 Feb 2019 08:32:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Using-a-token-in-a-search/m-p/315893#M20290</guid>
      <dc:creator>nkkn87</dc:creator>
      <dc:date>2019-02-28T08:32:07Z</dc:date>
    </item>
  </channel>
</rss>

