topic Re: Tokens in Splunk Search

Tokens

kwholley63 — Tue, 15 Dec 2020 12:09:27 GMT

I have a dashboard with two panels. One is sales data and one is returns. I would like to have a drop down that I enter the store number and it updates both panels with that number. In the query I have storeno= and the token should be passed to both query dashboards here. How do I do that?

thank you

Re: Tokens

kamlesh_vaghela — Tue, 15 Dec 2020 13:00:53 GMT

@kwholley63

Just take below xml as example and observe the `tkn_storeno` token.

<form> <label>Token Usage</label> <fieldset submitButton="false"> <input type="text" token="tkn_storeno" searchWhenChanged="true"> <label>Store Number</label> </input> </fieldset> <row> <panel> <table> <search> <query>| makeresults count=10 | eval storeno=1 | accum storeno | where storeno="$tkn_storeno$"</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <search> <query>| makeresults count=10 | eval storeno=1 | accum storeno | where storeno="$tkn_storeno$" | stats count</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>

Re: Tokens

kwholley63 — Tue, 15 Dec 2020 22:16:17 GMT

Thank you for your reply. I'm still a bit confused, maybe I did not present this well.

I have a query lets call it query1 that looks at sales and I have storenumber=1 in that query I have query2 that looks at returns with storenumber=1 in the second query

I want to add these queries to my store's dashboard. Now in the dashboard, I want to have a box (text, dropdown, anything) where I can enter a new store number and run both those queries.

If I enter say 2 in that box how does that 2 get replaced in the queries where store number =1 to be storenumber=2 now?

I don't understand how modifying the underlying HTML does that. I thought it would be some token like variable?

Thank Yu for your time