topic set token with multiple values to different query in Dashboards & Visualizations

set token with multiple values to different query

nithys — Sun, 16 Mar 2025 15:53:20 GMT

The problem is token substitution in the dropdown input. Specifically:

Issue with entityToken Substitution:
- The first value of the dropdown choice (e.g., target or CB) is not being correctly substituted into the $entityToken$ token.

<form version="1.1" theme="dark"> <label>Stats local Clone1</label> <fieldset submitButton="true"> <input type="dropdown" token="entityTokenFirst"> <label>Select Data Entity</label>  <choice value="target,*-test-targetf">Target </choice> <choice value="CB,*-test-cb">CB</choice> <default>target,*-test-targetf</default> <change>  <set token="entityLabel">$label$</set> <eval token="searchName">mvindex(split($value$, ","), 1)</eval> <eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval> </change> </input> <input type="time" token="timeToken"> <label>Select Time Range</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <single> <title>Distinct Consumer Count for $entityLabel$</title> <search> <query> index="" source="**" | spath path=test.nsp3s{} output=nsp3s | mvexpand nsp3s | spath input=nsp3s path=Name output=Name | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount | search Name=$searchName$ | sort -_time | head 1 | fields DistinctAdminUserCount </query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> <row> <panel> <title>Total Request :</title> <single> <search> <query> index="$indexToken$" source IN ("*-data-$stageToken$-$entityTokenFirst$") msg=":data:invoke" | stats count </query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> <refresh>60m</refresh> <refreshType>delay</refreshType> </search> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="height">317</option> <option name="rangeColors">["0xcba700","0xdc4e41"]</option> <option name="rangeValues">[200]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.size">large</option> <option name="unitPosition">after</option> <option name="useColors">1</option> </single> </panel> </row> </form>

This is causing the $entityToken$ token to not reflect the expected value in queries where it is used, such as:

source IN ("/aws/lambda/*-data-$stageToken$-$entityToken$"

Correct Substitution for searchName:
- The second value of the dropdown choice (e.g., -test-targetf or *-test-cb) is being correctly substituted into the $searchName$ token.
- This indicates that the <eval> logic for searchName is working as expected:
  
  <eval token="searchName">mvindex(split($value$, ","), 1)</eval>
Potential Cause of the Problem:
- The <eval> logic for entityToken might not be working as expected:
  
  <eval token="entityToken">mvindex(split($value$, ","), 0)</eval?
- This could be due to:
  - A syntax issue in the <eval> block.
  - A conflict with the token name entityToken elsewhere in the dashboard.
  - The $value$ token not being properly passed or split.

Problem:

The first value of the dropdown choice (e.g., target or CBD) is not being correctly substituted into the $entityToken$ token in the Splunk dashboard.
This is causing queries that rely on $entityToken$ to fail or use incorrect values.

Expected Behavior:

$entityToken$ should be set to the first value of the selected dropdown choice (e.g., target or CB).
$searchName$ should be set to the second value of the selected dropdown choice (e.g., *-test-targetf or *-test-cb).

Current Behavior:

$searchName$ is correctly set to the second value of the dropdown choice.
$entityToken$ is not being set to the first value of the dropdown choice.

Impact:

Queries that rely on $entityToken$ are failing or using incorrect values, such as:

Re: set token with multiple values to different query

ITWhisperer — Sun, 16 Mar 2025 17:51:12 GMT

Your token name in the input is "entityTokenFirst" - you are then trying to reset this in the change handler - neither of these are "entityToken" (perhaps this is a typo?) - try using different names for the input token name and the token evaluated in the change handler.

Re: set token with multiple values to different query

nithys — Sun, 16 Mar 2025 19:18:25 GMT

@ITWhisperer

i am using the correct $entityTokenFirst$ in the eval token and query in the provided dashboard code .looks like i typed mistakenly as $entityToken$
<change>

<set token="entityLabel">$label$</set>
<eval token="searchName">mvindex(split($value$, ","), 1)</eval>
<eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
</change>
<query>
index="$indexToken$" source IN ("*-data-$stageToken$-$entityTokenFirst$") msg=":data:invoke"
| stats count
</query>

Re: set token with multiple values to different query

ITWhisperer — Sun, 16 Mar 2025 22:07:43 GMT

Try like this

<fieldset submitButton="true"> <input type="dropdown" token="entityToken"> <label>Select Data Entity</label>  <choice value="target,*-test-targetf">Target </choice> <choice value="CB,*-test-cb">CB</choice> <default>target,*-test-targetf</default> <change>  <set token="entityLabel">$label$</set> <eval token="searchName">mvindex(split($value$, ","), 1)</eval> <eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval> </change> </input> <input type="time" token="timeToken"> <label>Select Time Range</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset>

Re: set token with multiple values to different query

nithys — Mon, 17 Mar 2025 02:24:38 GMT

@ITWhisperer still seeing same error with below dashboard code .

<form version="1.1" theme="dark"> <label>Stats local Clone1</label> <fieldset submitButton="true"> <input type="dropdown" token="entityToken"> <label>Select Data Entity</label>  <choice value="target,*-test-targetf">Target </choice> <choice value="CB,*-test-cb">CB</choice> <default>target,*-test-targetf</default> <change>  <set token="entityLabel">$label$</set> <eval token="searchName">mvindex(split($value$, ","), 1)</eval> <eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval> </change> </input> <input type="time" token="timeToken"> <label>Select Time Range</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <single> <title>Distinct Consumer Count for $entityLabel$</title> <search> <query> index="" source="**" | spath path=test.nsp3s{} output=nsp3s | mvexpand nsp3s | spath input=nsp3s path=Name output=Name | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount | search Name=$searchName$ | sort -_time | head 1 | fields DistinctAdminUserCount </query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> <row> <panel> <title>Total Request :</title> <single> <search> <query> index="$indexToken$" source IN ("/aws/lambda/-data-$stageToken$-$entityTokenFirst$") msg="gemini:streaming:info:*:init:data:invoke" | stats count </query> <earliest>$timeToken.earliest$</earliest> <latest>$timeToken.latest$</latest> <refresh>60m</refresh> <refreshType>delay</refreshType> </search> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="height">317</option> <option name="rangeColors">["0xcba700","0xdc4e41"]</option> <option name="rangeValues">[200]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="trellis.size">large</option> <option name="unitPosition">after</option> <option name="useColors">1</option> </single> </panel> </row> </form>

Re: set token with multiple values to different query

ITWhisperer — Mon, 17 Mar 2025 08:15:42 GMT

stageToken is not being set