topic Re: Not Reading Dropdown Form Tokens in Splunk Search

Not Reading Dropdown Form Tokens

willial — Fri, 18 Jul 2014 13:25:42 GMT

I'm trying to use two dropdowns, one to select a fiscal quarter and one to select the fiscal year. These are both based off of choices rather than search-populated, as so:

    <fieldset>
  <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
  </input>
  <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
  </input>
  </fieldset>

The problem I'm having comes from trying to use these. The URL happily contains:

?form.qDropMo=Q1&form.qDropYr=2015

but a simple eval statement such as:

| eval quarterStartMo=if($form.qDropMo$="Q1",7,quarterStartMo)

returns nothing. Even something like:

| eval quarter = $form.qDropMo$

returns nothing. I'm very confused as to why I can't pull the form information into my search.

Re: Not Reading Dropdown Form Tokens

somesoni2 — Fri, 18 Jul 2014 13:52:21 GMT

The dropdown values are string and they need to be enclosed within double quotes while using them.

So change the searches like this.

| eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)

and 

| eval quarter = "$form.qDropMo$"

Update

See this runanywhere sample with your example dropdowns and it works for me.

<form>
   <label>Token Issue</label>
  <fieldset>
    <input type="dropdown" token="qDropMo" searchWhenChanged="true">
      <label>Select Fiscal Quarter</label>
      <choice value="Q1">Q1</choice>
      <choice value="Q2">Q2</choice>
      <choice value="Q3">Q3</choice>
      <choice value="Q4">Q4</choice>
      <default>Q1</default>
    </input>
    <input type="dropdown" token="qDropYr" searchWhenChanged="true">
      <label>Select Fiscal Year</label>
      <choice value="2013">2013</choice>
      <choice value="2014">2014</choice>
      <choice value="2015">2015</choice>
      <default>2015</default>
    </input>
  </fieldset>
  <row>
     <table>
      <title>SampleData</title>
      <searchString>| stats count as quarterStartMo | eval quarterStartMo=if("$form.qDropMo$"="Q1",7,quarterStartMo)
| eval quarter = "$form.qDropMo$"</searchString>
      <earliestTime>-15m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="count">5</option>     
    </table>
  </row>
</form>

Re: Not Reading Dropdown Form Tokens

willial — Fri, 18 Jul 2014 13:55:37 GMT

I've tried with and without the double quotes. It doesn't seem to make a difference here.

Re: Not Reading Dropdown Form Tokens

willial — Fri, 18 Jul 2014 18:19:43 GMT

I've found the culprit. I have a |stats (etc) line in the full search that is somehow interfering. If I remove the |stats line this works normally. I have no idea why.

Re: Not Reading Dropdown Form Tokens

somesoni2 — Fri, 18 Jul 2014 20:08:31 GMT

Can you post the full query, in case removing that stats part affects your need. Just ignore this if you're fine without it.