<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to modify a token in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682712#M55882</link>
    <description>&lt;P&gt;What about if you set the initial value as well as the default value?&lt;/P&gt;</description>
    <pubDate>Tue, 02 Apr 2024 10:29:14 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2024-04-02T10:29:14Z</dc:date>
    <item>
      <title>How to modify a token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682630#M55873</link>
      <description>&lt;P&gt;Hi community,&lt;/P&gt;
&lt;P&gt;I have a dropdown for environments like DEV/CT/PROD, and saved it into a token `SDLC`.&lt;BR /&gt;Now I would like to define another token `new_sdlc`. It's "ctpm" when `SDLC` is "pm"; Otherwise, it's the same value as `SDLC`.&lt;/P&gt;
&lt;P&gt;In the end, I found a way working but a bit stupid, simply because it seems "!=" is not allowed so I have to list all conditions.&lt;/P&gt;
&lt;P&gt;I've checked a few posts but didn't find a working and elegant way. I bet there is one. Looking forward to your help.&lt;BR /&gt;&lt;BR /&gt;Here is my code:&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;&amp;lt;fieldset submitButton="false"&amp;gt;
&amp;lt;input type="time" token="field1"&amp;gt;
&amp;lt;label&amp;gt;&amp;lt;/label&amp;gt;
&amp;lt;default&amp;gt;
&amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
&amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
&amp;lt;/default&amp;gt;
&amp;lt;/input&amp;gt;
&amp;lt;input type="dropdown" token="SDLC"&amp;gt;
&amp;lt;label&amp;gt;SDLC&amp;lt;/label&amp;gt;
&amp;lt;choice value="prod"&amp;gt;PROD&amp;lt;/choice&amp;gt;
&amp;lt;choice value="ct"&amp;gt;CT&amp;lt;/choice&amp;gt;
&amp;lt;choice value="pm"&amp;gt;PM&amp;lt;/choice&amp;gt;
&amp;lt;default&amp;gt;prod&amp;lt;/default&amp;gt;
&amp;lt;initialValue&amp;gt;prod&amp;lt;/initialValue&amp;gt;
&amp;lt;change&amp;gt;
&amp;lt;condition label="CT"&amp;gt;
&amp;lt;set token="new_sdlc"&amp;gt;ct&amp;lt;/set&amp;gt;
&amp;lt;/condition&amp;gt;
&amp;lt;condition label="PM"&amp;gt;
&amp;lt;set token="new_sdlc"&amp;gt;ctpm&amp;lt;/set&amp;gt;
&amp;lt;/condition&amp;gt;
&amp;lt;condition label="PROD"&amp;gt;
&amp;lt;set token="new_sdlc"&amp;gt;prod&amp;lt;/set&amp;gt;
&amp;lt;/condition&amp;gt;
&amp;lt;/change&amp;gt;
&amp;lt;/input&amp;gt;
&amp;lt;/fieldset&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Mon, 01 Apr 2024 17:14:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682630#M55873</guid>
      <dc:creator>syk19567</dc:creator>
      <dc:date>2024-04-01T17:14:03Z</dc:date>
    </item>
    <item>
      <title>Re: How to modify a token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682636#M55874</link>
      <description>&lt;P&gt;Try something like this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;change&amp;gt;
&amp;lt;eval token="new_sdlc"&amp;gt;if("$SDLC$"=="sldc","ctpm","$SDLC$")&amp;lt;/eval&amp;gt;
&amp;lt;/change&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Mon, 01 Apr 2024 16:24:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682636#M55874</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-04-01T16:24:28Z</dc:date>
    </item>
    <item>
      <title>Re: How to modify a token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682640#M55875</link>
      <description>&lt;P&gt;Thank you for the response! I had a try like this (maybe not exactly the same) before posting, and it didn't work.&lt;/P&gt;
&lt;P&gt;However, this time I pasted yours and after a slight change, it works!&lt;/P&gt;
&lt;P&gt;Now it's like:&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;if(SDLC=="pm","ctpm",SDLC)&lt;/LI-CODE&gt;
&lt;P&gt;So it seems I cannot use $ and quotes. After removing them, it's good!&lt;/P&gt;</description>
      <pubDate>Mon, 01 Apr 2024 17:14:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682640#M55875</guid>
      <dc:creator>syk19567</dc:creator>
      <dc:date>2024-04-01T17:14:34Z</dc:date>
    </item>
    <item>
      <title>Re: How to modify a token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682672#M55880</link>
      <description>&lt;P&gt;A problem I noticed is, the new token only gets a value when we change the origin token.&lt;/P&gt;&lt;P&gt;That's to say, when we opened the dashboard, although the origin token has a default value, the new token is null, thus the queries don't work. We'll see "Search is waiting for input "&lt;/P&gt;</description>
      <pubDate>Tue, 02 Apr 2024 01:05:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682672#M55880</guid>
      <dc:creator>syk19567</dc:creator>
      <dc:date>2024-04-02T01:05:32Z</dc:date>
    </item>
    <item>
      <title>Re: How to modify a token</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682712#M55882</link>
      <description>&lt;P&gt;What about if you set the initial value as well as the default value?&lt;/P&gt;</description>
      <pubDate>Tue, 02 Apr 2024 10:29:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-a-token/m-p/682712#M55882</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-04-02T10:29:14Z</dc:date>
    </item>
  </channel>
</rss>

