topic Re: How to write my token for a drop-down list search on my dashboard? in Splunk Search

How to write my token for a drop-down list search on my dashboard?

fmpa_isaac — Thu, 17 Dec 2015 19:55:26 GMT

Hi all,

I wanted to know if someone can help me figure out how to write my token for the following drop-down list search I trying to do on my dashboard. Please see below my XML code below. I am able to list the names within the field I am trying to get but it does not update the results. Thank you

<form>
  <label>Camilla</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="&quot;$CardholderName$=&quot;" searchWhenChanged="true">
      <label>Select a User:</label>
      <search>
        <query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description | 
dedup CardholderName | sort CardholderName</query>
      </search>
      <fieldForLabel>CardholderName</fieldForLabel>
      <fieldForValue>CardholderName</fieldForValue>
      <prefix>"$CardholderName$=</prefix>
      <suffix>"</suffix>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>

Re: How to write my token for a drop-down list search on my dashboard?

s2_splunk — Thu, 17 Dec 2015 21:19:27 GMT

Here is a simple example that shows you how it's done in general, adjust to your specific needs.

<form>
  <label>Token Test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="mySourcetype" searchWhenChanged="true">
      <label>Select a Sourcetype:</label>
      <search>
        <query>index=_internal earliest=-30m |stats values(sourcetype) as st | mvexpand st</query>
      </search>
      <fieldForLabel>st</fieldForLabel>
      <fieldForValue>st</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Count for sourcetype: $mySourcetype$</title>
      <table>
        <search>
          <query>index=_internal earliest=-30m sourcetype=$mySourcetype$</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>

Re: How to write my token for a drop-down list search on my dashboard?

fmpa_isaac — Fri, 18 Dec 2015 15:54:05 GMT

Thank you, I see now that it filters on the person I want to see. However, when the search is set to all, the column is eliminated so I can't see all of the user names. If I choose a name on my drop down list, it then puts the column back on the report as CarholderName=Barbosa,Isaac but it does not list my name next to the records.

Camilla

<input type="dropdown" token="CardholderName" searchWhenChanged="true">
  <label>Select a User:</label>
  <search>
    <query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description |  dedup CardholderName | sort CardholderName</query>
  </search>
  <fieldForLabel>CardholderName</fieldForLabel>
  <fieldForValue>CardholderName</fieldForValue>
  <choice value="*">All</choice>
  <default>*</default>
  <prefix>"CardholderName=</prefix>
  <suffix>"</suffix>
</input>


<panel>
  <table>
    <search>
      <query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, $CardholderName$, Access_Point_Description</query>
      <earliest></earliest>
      <latest></latest>
    </search>
  </table>
</panel>