topic Re: how to use one token with different evaluation for 2 panels query under different conditions. in Splunk Search

how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 03:38:21 GMT

Hi, Splunkers，

I have a dashboard with 2 panels.

there is one input token, Gucid_token,

what I need is when Gucid_token is any string but not a 1 or 2 digits number, then use it as search string for panle1's query , in this case, this token has nothing to do with panel 2 query.

panel1

<query>sourcetype="omni:ors:voice" $Gucid_token$

Panel2

<query>sourcetype="omni:ors:voice" keyword1 keyword2 | search skilllength >1

when Gucid_token is a 1 or 2 digits number, then ignore it in panel1's query, but for panel2's query, use this

token to build search like search skilllength > $Gucid_token$

panel1

<query>sourcetype="omni:ors:voice"

Panel2

<query>sourcetype="omni:ors:voice" keyword1 keyword2 | search skilllength > $Gucid_token$

thx in advance.

Kevin

Re: how to use one token with different evaluation for 2 panels query under different conditions.

ITWhisperer — Tue, 11 Jan 2022 06:29:16 GMT

In the change handler of the input, set up two tokens, one for each panel, based on the evaluation of the input.

Re: how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 13:50:22 GMT

I need a hidden feature from this input field. that's why I don't want to use 2 inputs for this.

Kevin

Re: how to use one token with different evaluation for 2 panels query under different conditions.

ITWhisperer — Tue, 11 Jan 2022 14:07:07 GMT

You are not understanding what I am saying. In the change handler for the input, you can set multiple tokens. You still have one input and the hidden feature is that more than one token is set up when the input changes.

Re: how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 14:38:03 GMT

Ok, I kinda understand your suggestion.

you meant having this logic developed in input change handler, instead of in each panel's query.

but how to have 2 different handlers with two tokens in one input?

can you show me some sample code here? I am a junior splunker....

thx.

Kevin

Re: how to use one token with different evaluation for 2 panels query under different conditions.

ITWhisperer — Tue, 11 Jan 2022 15:34:30 GMT

<input type="text" token="Gucid_token"> <label>$Gucid_token$ - Panel 1 token: $panel1_token$ - Panel 2 token: $panel2_token$</label> <change> <eval token="panel1_token">if(match(value, "^[0-9][0-9]?$"),"", value)</eval> <eval token="panel2_token">if(match(value, "^[0-9][0-9]?$"),value, 1)</eval> </change> </input>

Re: how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 16:20:26 GMT

thank you very much, I will give a try.

Re: how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 17:06:14 GMT

thank you very much, works amazingly....

Re: how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 18:12:26 GMT

Hi, ITWhisperer,

since my original token name is Gucid_token, so, I still keep it for panel 1 query, in this way I don't have to change any other original code related to Gucid_token.

but then I noticed some drilldown click stop working, which tries to open the same dashboard.

why this form.Gucid_token=$click.value2$ to pass cell value to open the same dashboard stop working?

I attached the full open link at the bottom.

<label>Gucid/UUID/SID</label>

<eval token="Gucid_token">if(match(value, "^[0-9][0-9]?$"),"", value)</eval>

<eval token="skillexpressionLength">if(match(value, "^[0-9][0-9]?$"),value, 0)</eval>

</change>

</input>

</drilldown>

kevin

Re: how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 18:14:17 GMT

BTW， I clicked the same cell I always clicked.. so, the value is a valid value for panel query 1.

Kevin

Re: how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 18:28:20 GMT

Besides, my drilldown click is to open two dashboards, one is itself, the other one different dashboard,

different dashboard got the passed cellvalue.

Kevin

Re: how to use one token with different evaluation for 2 panels query under different conditions.

ITWhisperer — Tue, 11 Jan 2022 18:34:44 GMT

You changed the name of the input form token - try the drilldown like this

Re: how to use one token with different evaluation for 2 panels query under different conditions.

wangkevin1029 — Tue, 11 Jan 2022 18:56:34 GMT

it works, makes perfect sense....

one it global variable, the other two are local variables.

thanks again.

Kevin