topic Re: How to pass an eval string as a token in Dashboards & Visualizations

How to pass an eval string as a token

mwdbhyat — Thu, 21 Mar 2019 19:08:30 GMT

Hi there,

I am trying to populate an input text box with an eval case statement - not using the function but simply placing the text for the eval statement in to the text box by using a token. This gets saved in a lookup file and then read using inputlookup to populate the text box with the value in my dash.

<input type="text" token="mytoken" searchWhenChanged="true">
  <label>mytoken</label>
  <default>"case(dow==\"Mon\",\"dow_Mtwtfss\",true(),\"dow_mTWTFSS\")"</default>
  <initialValue>"case(dow==\"Mon\",\"dow_Mtwtfss\",true(),\"dow_mTWTFSS\")"</initialValue>

| eval mytokenoutput="$mytoken$"
|outputlookup bla.csv

The inputlookup command then reads the lookup file token and places that token in the text box - but not if i use "case".

So I have escaped the the case statement to just input the string, but it still doesnt work. If i just put normal text in there - it works. If i do all of this in a search scenario rather than token/dashboard scenario it also works.

Any thoughts ?

Thanks!

Re: How to pass an eval string as a token

cmerriman — Fri, 22 Mar 2019 01:48:31 GMT

try this:

<form>
  <label>test_splunkanswers</label>
  <fieldset>
    <input type="text" token="mytoken" searchWhenChanged="true">
      <label>mytoken</label>
      <default>case(dow=="Mon","dow_Mtwtfss",true(),"dow_mTWTFSS")</default>
      <initialValue>case(dow=="Mon","dow_Mtwtfss",true(),"dow_mTWTFSS")</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults| eval mytokenoutput=$mytoken$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

i removed all of the escaped double quotes and the double quotes around the string, because you want it to actually eval this in the end, and not treat it as a string.

Re: How to pass an eval string as a token

mwdbhyat — Mon, 25 Mar 2019 10:10:59 GMT

@cmerriman thanks for getting back to me! The problem is that if I dont escape everything it will not dump it all to the csv file which kinda breaks my dashboard.. Escaping everything works but doesnt make a good default/initial value because obviously it wouldnt run the case statement first time round.