<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to pass drop down token in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550754#M38047</link>
    <description>Can you please share your sample XML? So we can check which token you are using at what place and other things.</description>
    <pubDate>Fri, 07 May 2021 04:55:08 GMT</pubDate>
    <dc:creator>kamlesh_vaghela</dc:creator>
    <dc:date>2021-05-07T04:55:08Z</dc:date>
    <item>
      <title>How to pass drop down token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550747#M38046</link>
      <description>&lt;P&gt;Hi Guys,&lt;/P&gt;&lt;P&gt;I got my query right and I see my values properly populate on the dropdown input. However, I cant pass this token to populate my query on to the next query. Is there something wrong with my xml?&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;input type="dropdown" token="sourceName" searchWhenChanged="true"&amp;gt;

      &amp;lt;label&amp;gt;Select SourceName&amp;lt;/label&amp;gt;

      &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;

      &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;

      &amp;lt;fieldForLabel&amp;gt;sourcename&amp;lt;/fieldForLabel&amp;gt;

      &amp;lt;fieldForValue&amp;gt;sourcename&amp;lt;/fieldForValue&amp;gt;

      &amp;lt;search&amp;gt;

        &amp;lt;query&amp;gt;index="example_of_idx" sourcename=Service_Requested OR sourcename=Service_Suggested | stats count by sourcename  | replace  Service_Requested WITH "Type of Service"  Service_Suggested WITH "Type of Service Suggested" IN sourcename | table sourcename &amp;lt;/query&amp;gt;

      &amp;lt;/search&amp;gt;

    &amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 07 May 2021 02:41:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550747#M38046</guid>
      <dc:creator>MeMilo09</dc:creator>
      <dc:date>2021-05-07T02:41:42Z</dc:date>
    </item>
    <item>
      <title>Re: How to pass drop down token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550754#M38047</link>
      <description>Can you please share your sample XML? So we can check which token you are using at what place and other things.</description>
      <pubDate>Fri, 07 May 2021 04:55:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550754#M38047</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2021-05-07T04:55:08Z</dc:date>
    </item>
    <item>
      <title>Re: How to pass drop down token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550760#M38048</link>
      <description>&lt;P&gt;Your query search seems to only return two values "Service_Requested" and "Service_Suggested" (assuming they exist in example_of_idx), which you then replace with phrases with embedded spaces. If you are using these values (with embedded spaces), are you protecting the spaces e.g. do you use the token filter |s to wrap the token value in quotes? Also, do you actually want the replacement string passed or is that really just for the dropdown? If it is for the dropdown, you should do something like this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;input type="dropdown" token="sourceName" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Select SourceName&amp;lt;/label&amp;gt;
      &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;label&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;sourcename&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search&amp;gt;
        &amp;lt;query&amp;gt;index="example_of_idx" sourcename=Service_Requested OR sourcename=Service_Suggested | stats count by sourcename | eval label=sourcename | replace  Service_Requested WITH "Type of Service"  Service_Suggested WITH "Type of Service Suggested" IN label | table sourcename label&amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
    &amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 07 May 2021 06:32:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550760#M38048</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-05-07T06:32:15Z</dc:date>
    </item>
    <item>
      <title>Re: How to pass drop down token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550904#M38062</link>
      <description>&lt;P&gt;Thanks!&amp;nbsp;&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp; the eval command did fixed the problem.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 07 May 2021 19:09:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pass-drop-down-token/m-p/550904#M38062</guid>
      <dc:creator>MeMilo09</dc:creator>
      <dc:date>2021-05-07T19:09:21Z</dc:date>
    </item>
  </channel>
</rss>

