topic Re: How to replace the value of a field by a token value in an xml form? in Splunk Search

How to replace the value of a field by a token value in an xml form?

stephane_cyrill — Fri, 17 Apr 2015 14:33:07 GMT

Hi everyone,

I have a field call status, and I have a drop-down with values: open, new, in progress.......

What i need is:

1) When the user chooses a value from the drop-down, the status on the dashboard changes to that value

2) Is it possible to keep track of the changing of the status? How?

This is what I've tried:

<form>
  <label>CHANGE STATUS</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="status_token" searchWhenChanged="true">
      <label>Change status</label>
      <choice value="new">new</choice>
      <default>new</default>
      <choice value="Open">Open</choice>
      <choice value="Closed">Closed</choice>
      <choice value="progress">in progress</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title> </title>
      <table>
        <title>status is $status_token$</title>
        <search>
          <query>index=_* |eval status="change this status"|eval status=if($status_token$!="change this status",$status_token$ ,"change this status")| table host source status</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

Re: How to replace the value of a field by a token value in an xml form?

Raghav2384 — Fri, 17 Apr 2015 16:17:18 GMT

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

Re: How to replace the value of a field by a token value in an xml form?

stephane_cyrill — Fri, 17 Apr 2015 17:11:04 GMT

THanks Raghav2384

very much I try the quote on the token an it is working: status="$status_token$"

Re: How to replace the value of a field by a token value in an xml form?

Raghav2384 — Fri, 17 Apr 2015 17:13:54 GMT

Please feel free to accept it as an answer 🙂

Re: How to replace the value of a field by a token value in an xml form?

stephane_cyrill — Fri, 17 Apr 2015 17:23:53 GMT

I"m not seeing the link to accept but I voted.

Re: How to replace the value of a field by a token value in an xml form?

Raghav2384 — Fri, 17 Apr 2015 17:23:54 GMT

there you go 🙂