topic Re: how to extract value from a token in Dashboards & Visualizations

how to use range of numbers in token

anooshac — Fri, 21 Jan 2022 14:02:34 GMT

Hi all, I have a token "Duration", and the values which will be passed to the drilldown are duration<15, 15<duration<=25 and duration>25. How can i pass the value 15-25 as a token?

Re: how to extract value from a token

isoutamo — Fri, 21 Jan 2022 07:11:47 GMT

When you are using g token on dashboards, use it in SPL just $token_name$.

https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/tokens

Re: how to extract value from a token

gcusello — Fri, 21 Jan 2022 07:12:44 GMT

Hi @anooshac,

you could use a dropdown list or a radio button with three static options, something like this:

<input type="dropdown" token="range"> <label>Range</label> <choice value="duration<16">duration<15</choice> <choice value="(duration>15 AND duration<=25)">15<duration<=25</choice> <choice value="duration>25">duration>25</choice> <default>duration<16</default> <prefix></prefix> <suffix></suffix> <search> <query></query> </search> </input>

and then use the clicked value in a search command.

| search $range$

Ciao.

Giuseppe

Re: how to extract value from a token

anooshac — Fri, 21 Jan 2022 13:22:32 GMT

I tried directly using the token but it doesn't work for the numbers with range. How can i pass a range 15-25 in a token ?

Re: how to extract value from a token

anooshac — Fri, 21 Jan 2022 13:27:32 GMT

Actually i want to pass the value to a table to populate the data. Do you know how to pass 15-25 directly as a token?

Re: how to extract value from a token

gcusello — Fri, 21 Jan 2022 14:00:29 GMT

Hi @anooshac,

if you have only one threshold (e.g. duratiopn<15 or duration>=15), you could pass only the value, but there's the intermediate range that has two conditions to check (duration>15 AND duration<=25), for this reason I hint to pass the full condition to use in the where command, as you can see in my sample.

If you want to pass only the value, you could use two dropdowns: one for the minimum and one for the maximum range.

Ciao.

Giuseppe

Re: how to extract value from a token

anooshac — Fri, 21 Jan 2022 14:15:42 GMT

Can i pass the value 15-25 as whole? Is there anything that can solve this?

Re: how to extract value from a token

gcusello — Fri, 21 Jan 2022 14:19:15 GMT

Hi @anooshac,

no, this is a range, a range is always composed by two conditions, so you cannot do in a different way.

What's the problem to use a condition like the one I showed?

Ciao.

Giuseppe

Re: how to extract value from a token

anooshac — Mon, 24 Jan 2022 04:11:25 GMT

hi, Your solution is perfect. But what i have is a bar chart which has these 3 groups and when i click any of the bar it should pass the value to the table in the drill down. I don't know that is possible.

Re: how to extract value from a token

gcusello — Mon, 24 Jan 2022 07:33:56 GMT

Hi @anooshac,

you could pass in the drilldown the condition (1, 2 or 3) and then manage in the secondary form the condition:

| eval minor=case(cond=1,0,cond=2,15,cond=3,25), major=case(cond=1,15,cond=2,25,cond=3,100000000000000000000000) | search duration>minor duration<=major

Ciao.,

Giuseppe

Re: how to extract value from a token

anooshac — Tue, 25 Jan 2022 05:42:12 GMT

should i add the condition as |where cond=1 2 or 3 in the query?

Re: how to extract value from a token

gcusello — Tue, 25 Jan 2022 07:30:37 GMT

Hi @anooshac,

in the drilldown you have to pass the condition and in the searches of the secondaty dashboard you have to use the eval and search commands I hinted.

Ciao.

Giuseppe