topic Re: How to use token value in stats group by field in Splunk dashboard in Splunk Search

How to use token value in stats group by field in Splunk dashboard

kasimanikandan — Fri, 07 Jun 2024 05:48:16 GMT

Hi Team,

I have stats group by fields as token it will change dynamically based on time selection. for example if select since 1st Jun 24 then my query will be like below.

eventtype="abc" |stats count by a,b,c

and if select date before 1st Jun 2024 i.e 30th May 2024 i would like to have stats group by field like below.

eventtype="abc" |stats count by a,d,e

So my current implementation is putting group by field in token, token will be set based on time selection and final query would be like below.

eventtype="abc" |stats count by $groupby_field$

Now the issue is splunk dashboard says waiting for input the moment i add token input to stats groupby field.

Appreciate your suggestion/help to handle this scenario.

Thanks,

Mani

Re: How to use token value in stats group by field in Splunk dashboard

ITWhisperer — Fri, 07 Jun 2024 06:53:37 GMT

Assuming you are changing the groupby_field token in the change handler of the time selection input, which is essentially the input that is being waited for, you could also initialise the groupby_field token in an init block in SimpleXML - it is perhaps a little more complicated to do in Studio

Re: How to use token value in stats group by field in Splunk dashboard

kasimanikandan — Tue, 11 Jun 2024 03:24:20 GMT

@ITWhisperer didnt worked

Re: How to use token value in stats group by field in Splunk dashboard

bowesmana — Tue, 11 Jun 2024 07:12:11 GMT

That sort of response is unlikely to elicit further help from anyone.

Please describe what you have done, and if possible post snippets of your token management logic in your dashboard