<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Fetch additional Tokens in Dropdown to populate a HTML user text in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522872#M35310</link>
    <description>&lt;P&gt;Unfortunately, one cannot put a &lt;FONT face="courier new,courier"&gt;&amp;lt;query&amp;gt;&lt;/FONT&gt; tag anywhere in a dashboard's code to run a search.&amp;nbsp; The &lt;FONT face="courier new,courier"&gt;&amp;lt;query&amp;gt;&lt;/FONT&gt; tag is valid only within a &lt;FONT face="courier new,courier"&gt;&amp;lt;search&amp;gt;&lt;/FONT&gt;, which (in this context) can only be used to populate input choices.&lt;/P&gt;</description>
    <pubDate>Sun, 04 Oct 2020 20:50:48 GMT</pubDate>
    <dc:creator>richgalloway</dc:creator>
    <dc:date>2020-10-04T20:50:48Z</dc:date>
    <item>
      <title>Fetch additional Tokens in Dropdown to populate a HTML user text</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522870#M35308</link>
      <description>&lt;P&gt;lookup_file.csv has the data as below&lt;BR /&gt;&lt;EM&gt;dId,count,perc&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;Usecase : User to select dropdown based on lookup dId field. Once select, I want to populate &lt;STRONG&gt;count&lt;/STRONG&gt; and &lt;STRONG&gt;perc&lt;/STRONG&gt; for that &lt;STRONG&gt;dId&lt;/STRONG&gt; selected as a html text.&lt;BR /&gt;So that user known the &lt;STRONG&gt;count&lt;/STRONG&gt; and &lt;STRONG&gt;perc&lt;/STRONG&gt;&amp;nbsp;for the dropdown selected&amp;nbsp;&lt;STRONG&gt;dId&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;panel&amp;gt;
  &amp;lt;input type="dropdown" token="lookup_Id" searchWhenChanged="true"&amp;gt;
    &amp;lt;label&amp;gt;Select ID&amp;lt;/label&amp;gt;
    &amp;lt;fieldForLabel&amp;gt;id&amp;lt;/fieldForLabel&amp;gt;
    &amp;lt;fieldForValue&amp;gt;dId&amp;lt;/fieldForValue&amp;gt;
    &amp;lt;search&amp;gt;
      &amp;lt;query&amp;gt;| inputlookup lookup_file.csv&amp;lt;/query&amp;gt;
      &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
      &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
    &amp;lt;/search&amp;gt;
    &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
    &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;change&amp;gt;
      &amp;lt;condition value="$lookup_Id$"&amp;gt;
         &amp;lt;set token="count"&amp;gt;&amp;lt;query&amp;gt;|inputlookup lookup_file.csv | where dId="$lookup_Id$" | table count&amp;lt;/query&amp;gt;&amp;lt;/set&amp;gt;
         &amp;lt;set token="perc"&amp;gt;&amp;lt;query&amp;gt;|inputlookup lookup_file.csv | where dId="$lookup_Id$" | table perc&amp;lt;/query&amp;gt;&amp;lt;/set&amp;gt;
       &amp;lt;/condition&amp;gt;
    &amp;lt;/change&amp;gt;
  &amp;lt;/input&amp;gt;
  &amp;lt;html&amp;gt;
   &amp;lt;i&amp;gt;$lookup_Id$: Count is $count$, Percentage is $perc$&amp;lt;/i&amp;gt;
  &amp;lt;/html&amp;gt;  
&amp;lt;/panel&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Currenlty i get&lt;/P&gt;&lt;P&gt;&lt;EM&gt;&lt;FONT color="#0000FF"&gt;"001": Count is&lt;/FONT&gt; &lt;FONT color="#FF0000"&gt;|inputlookup lookup_file.csv | where dId="$lookup_Id$" | table count&lt;/FONT&gt;, &lt;FONT color="#0000FF"&gt;Percentage is &lt;/FONT&gt;&lt;FONT color="#FF0000"&gt;&lt;FONT color="#0000FF"&gt;|&lt;/FONT&gt;inputlookup lookup_file.csv | where dId="$lookup_Id$" | table perc&lt;/FONT&gt;&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;Meaning the dId is populated correctly, but other 2 tokens under change/condition is not not evaluating rather printed as-is query string.&lt;/P&gt;&lt;P&gt;Please help me on this.&lt;/P&gt;</description>
      <pubDate>Sun, 04 Oct 2020 20:18:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522870#M35308</guid>
      <dc:creator>rangarbus</dc:creator>
      <dc:date>2020-10-04T20:18:47Z</dc:date>
    </item>
    <item>
      <title>Re: Fetch additional Tokens in Dropdown to populate a HTML user text</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522872#M35310</link>
      <description>&lt;P&gt;Unfortunately, one cannot put a &lt;FONT face="courier new,courier"&gt;&amp;lt;query&amp;gt;&lt;/FONT&gt; tag anywhere in a dashboard's code to run a search.&amp;nbsp; The &lt;FONT face="courier new,courier"&gt;&amp;lt;query&amp;gt;&lt;/FONT&gt; tag is valid only within a &lt;FONT face="courier new,courier"&gt;&amp;lt;search&amp;gt;&lt;/FONT&gt;, which (in this context) can only be used to populate input choices.&lt;/P&gt;</description>
      <pubDate>Sun, 04 Oct 2020 20:50:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522872#M35310</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2020-10-04T20:50:48Z</dc:date>
    </item>
    <item>
      <title>Re: Fetch additional Tokens in Dropdown to populate a HTML user text</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522886#M35314</link>
      <description>&lt;P&gt;Thanks. Is there any solution option to get the additional columns from inputlookup based on dropdown choice selected into tokens, so that i can use that on HTML text.?&lt;/P&gt;</description>
      <pubDate>Mon, 05 Oct 2020 02:08:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522886#M35314</guid>
      <dc:creator>rangarbus</dc:creator>
      <dc:date>2020-10-05T02:08:59Z</dc:date>
    </item>
    <item>
      <title>Re: Fetch additional Tokens in Dropdown to populate a HTML user text</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522896#M35317</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/226197"&gt;@rangarbus&lt;/a&gt;&amp;nbsp;you may have two options to do this.&lt;/P&gt;&lt;P&gt;Option 1: Populate Count an Perc suffixed to the existing dropdown value did and use &amp;lt;eval&amp;gt; to set required tokens.&lt;BR /&gt;&lt;BR /&gt;Option 2: Run an independent search which processes the value of did and sets required tokens count and percentage.&lt;BR /&gt;&lt;BR /&gt;In either case first improve the performance of your Dropdown by running an optimized search. As of now you may not see the issue in case you have less rows and columns but your performance issues for Dropdown loading and overall dashboard will aggravate as records increase.&lt;BR /&gt;&lt;BR /&gt;Following is a run anywhere example showcasing both example using a dummy search to mimic inputlookup data similar to your use case.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Screen Shot 2020-10-05 at 11.33.45 AM.png" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/11113i477DA12CD1CE8E41/image-size/large?v=v2&amp;amp;px=999" role="button" title="Screen Shot 2020-10-05 at 11.33.45 AM.png" alt="Screen Shot 2020-10-05 at 11.33.45 AM.png" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;Screen Shot 2020-10-05 at 11.33.45 AM.png&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Following is the required Simple XML code which you can adjust as per your actual use case/code.&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;form&amp;gt;
  &amp;lt;label&amp;gt;Dropdown with multiple Tokens&amp;lt;/label&amp;gt;
  &amp;lt;fieldset submitButton="false"&amp;gt;&amp;lt;/fieldset&amp;gt;
  &amp;lt;!-- TEST ONLY - token to mimic inputlookup scenario--&amp;gt;
  &amp;lt;init&amp;gt;
    &amp;lt;set token="inputLookup_LookupFile"&amp;gt;makeresults count=3
| fields - _time
| streamstats count as sno
| eval id=sno, dId="ABC-".sno, count=substr(tostring(random()),1,2)
| eventstats sum(count) as Total
| eval perc=round((count/Total)*100,1)&amp;lt;/set&amp;gt;
  &amp;lt;/init&amp;gt;
  &amp;lt;!-- Independent Search to Set multiple tokens based on Dropdown value --&amp;gt;
  &amp;lt;search&amp;gt;
    &amp;lt;query&amp;gt;| $inputLookup_LookupFile$ 
    | search dId="$lookup_Id2$"
    | fields dId count perc
    &amp;lt;/query&amp;gt;
    &amp;lt;done&amp;gt;
      &amp;lt;set token="count2"&amp;gt;$result.count$&amp;lt;/set&amp;gt;
      &amp;lt;set token="perc2"&amp;gt;$result.perc$&amp;lt;/set&amp;gt;
    &amp;lt;/done&amp;gt;
  &amp;lt;/search&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;title&amp;gt;Option 1 : Using eval to set token from Dropdown change event handler&amp;lt;/title&amp;gt;
      &amp;lt;input type="dropdown" token="lookup_Id1" searchWhenChanged="true"&amp;gt;
        &amp;lt;label&amp;gt;Select ID&amp;lt;/label&amp;gt;
        &amp;lt;fieldForLabel&amp;gt;id&amp;lt;/fieldForLabel&amp;gt;
        &amp;lt;fieldForValue&amp;gt;value&amp;lt;/fieldForValue&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| $inputLookup_LookupFile$
| fields id dId count perc
| eval value=dId."|".count."|".perc
| table id value&amp;lt;/query&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;change&amp;gt;
          &amp;lt;eval token="dId1"&amp;gt;mvindex(split($value$,"|"),0)&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="count1"&amp;gt;mvindex(split($value$,"|"),1)&amp;lt;/eval&amp;gt;
          &amp;lt;eval token="perc1"&amp;gt;mvindex(split($value$,"|"),2)&amp;lt;/eval&amp;gt;
        &amp;lt;/change&amp;gt;
      &amp;lt;/input&amp;gt;
      &amp;lt;html&amp;gt;
        &amp;lt;div&amp;gt;
          &amp;lt;div&amp;gt;lookup_Id1: $lookup_Id1$&amp;lt;/div&amp;gt;
          &amp;lt;div&amp;gt;dId1: $dId1$&amp;lt;/div&amp;gt;
          &amp;lt;div&amp;gt;count1: $count1$&amp;lt;/div&amp;gt;
          &amp;lt;div&amp;gt;perc1: $perc1$&amp;lt;/div&amp;gt;
        &amp;lt;/div&amp;gt;
      &amp;lt;/html&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;title&amp;gt;Option 2 : Using independent search to set token from Dropdown value token&amp;lt;/title&amp;gt;
      &amp;lt;input type="dropdown" token="lookup_Id2" searchWhenChanged="true"&amp;gt;
        &amp;lt;label&amp;gt;Select ID&amp;lt;/label&amp;gt;
        &amp;lt;fieldForLabel&amp;gt;id&amp;lt;/fieldForLabel&amp;gt;
        &amp;lt;fieldForValue&amp;gt;dId&amp;lt;/fieldForValue&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| $inputLookup_LookupFile$
| fields id dId&amp;lt;/query&amp;gt;
        &amp;lt;/search&amp;gt;
      &amp;lt;/input&amp;gt;
      &amp;lt;html&amp;gt;
        &amp;lt;div&amp;gt;
          &amp;lt;div&amp;gt;lookup_Id2: $lookup_Id2$&amp;lt;/div&amp;gt;
          &amp;lt;div&amp;gt;dId2: $lookup_Id2$&amp;lt;/div&amp;gt;
          &amp;lt;div&amp;gt;count2: $count2$&amp;lt;/div&amp;gt;
          &amp;lt;div&amp;gt;perc2: $perc2$&amp;lt;/div&amp;gt;
        &amp;lt;/div&amp;gt;
      &amp;lt;/html&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Mon, 05 Oct 2020 06:09:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/522896#M35317</guid>
      <dc:creator>niketn</dc:creator>
      <dc:date>2020-10-05T06:09:14Z</dc:date>
    </item>
    <item>
      <title>Re: Fetch additional Tokens in Dropdown to populate a HTML user text</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/523103#M35352</link>
      <description>&lt;P&gt;Option 1 - For some reason, did not return the tokens rather returned null.&lt;/P&gt;&lt;P&gt;Option 2 - Worked very well . Thank you so much!&lt;/P&gt;</description>
      <pubDate>Tue, 06 Oct 2020 03:28:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Fetch-additional-Tokens-in-Dropdown-to-populate-a-HTML-user-text/m-p/523103#M35352</guid>
      <dc:creator>rangarbus</dc:creator>
      <dc:date>2020-10-06T03:28:55Z</dc:date>
    </item>
  </channel>
</rss>

