topic Re: how to have one droplist input used for 2 panels with adding suffix for one panel? in Splunk Search

how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 03:56:33 GMT

Hi,Splunkers,

I have a dashboard with 2 Panels， which share one droplist input.

droplist has name/values as ALL/*, a/a, b/b, c/c, etc.

for panel 1, whatever is selected, | search fieldname = $tokename$,

but for panel 2, when ALL/* selected, |search fieldname = $tokenname$ as panel1, but when other values are selected, Iwant a suffix _CB to be added at the end, for example, when a/a selected, search should be built like |search fieldname=a_CB.

thx in advance.

Kevin

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

ITWhisperer — Wed, 19 Jan 2022 06:30:13 GMT

Set another token in the change handler of the dropdown to add the _CB to the dropdown token value.

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 07:04:49 GMT

Hi, ITWhisperer,

I did remember what you explained to me last time for that hidden feature in a text input.

not very familiar with the grammar here.

<label>Virtual Queue</label>

<eval token="t_VQ"></eval> ( this one is for Panel1, value no change), should I leave here blank?

<eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval> (this one is for panel2, if value is *, keep value no change, if not *, value+"_CB")

</change>

</input>

I tried this, but doesn't work.

Kevin

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

ITWhisperer — Wed, 19 Jan 2022 07:36:21 GMT

Either change the token name for the dropdown to t_VQ or assign t_VQ the the value of the t_VQ_with2Handlers token

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 07:41:24 GMT

<label>Virtual Queue</label>

<eval token="t_VQ">t_VQ = t_VQ_with2Handlers</eval> like this ?do I still need $ symbol?

<eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval> (this one is for panel2, if value is *, keep value no change, if not *, value+"_CB")

</change>

BTW， is the 2nd <eval token- correct?

Kevin

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

ITWhisperer — Wed, 19 Jan 2022 07:44:27 GMT

Try it like this

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

The other eval looks like it might work

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 13:29:47 GMT

Hi,ITWhisperer,

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

<eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval>

</change>

1st token t_VQ works as expected, but 2nd token t_VQ_CB,

| search VQ=$t_VQ_CB$ (VQ is the field name),

in the panel, why always showing Search is waiting for input... it looks there is some syntax error?

Kevin

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 13:53:06 GMT

should I use \ to convert *? but I did try it as below, doesn't work either.

<eval token="t_VQ_CB">if(match(value, "\*"),value, value+"_CB")</eval>

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

ITWhisperer — Wed, 19 Jan 2022 15:31:37 GMT

You could try if(value=="*",value,value."_CB")

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 15:35:41 GMT

Hi,ITWhisperer,

After more testing for token 1 t_VQ,

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

I noticed when I load the dashboard at the beginning, the panel using this token also shows search is waiting for input (default/initial value are ALL/*),

I have to reselect other value, then change back to ALL/*, then search works.

it's odd why initial load doesn't take dropdown selection?

Kevin

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

ITWhisperer — Wed, 19 Jan 2022 15:42:47 GMT

I suspect it just a timing issue as it is loading the dashboard. You could try creating an init block at the top of the dashboard an initialise all the tokens to their default value

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 16:20:27 GMT

Hi,ITWhisperer,

initial loading for token 2 works perfectly.

but for token 1, after I added the following <init></init> at the top, still showing search waiting for input, and I can't open search to check how exactly the search is built.

Kevin

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

ITWhisperer — Wed, 19 Jan 2022 16:25:37 GMT

Perhaps if you could share your SimpleXML in a code block </> we might be able to spot what is going wrong?

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 16:26:19 GMT

or something wrong here? only reselection of this dropdown can refresh value here?

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 22:06:17 GMT

1st and 2nd panels using token 1 don't work.

3nd panel using token 2 works perfectly.

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029 — Wed, 19 Jan 2022 19:23:03 GMT

<eval token="t_VQ">if(value=="*",value,value)</eval>

I changed 1st token to if... like 2nd token, it looks it works fine.

will do more testing.

Btw, will this unnecessary "if" expression causes a little unnecessary performance issue?

Kevin

Re: how to have one droplist input used for 2 panels with adding suffix for one panel?

ITWhisperer — Wed, 19 Jan 2022 21:31:10 GMT

Not significantly since it only evaluated when the input dropdown is evaluated