Can I pass a token in Dashboard with 2 values?

[kiran331]

Hi,

I have a Dashboard using two different searches. I have a drop down with zone1 and zone2. Is there a way when I select a zone1 to pass two values, each for each panel?

[somesoni2]

Assuming your dropdown selection values zone1 and zone2 are static, you set the token value from the dropdown to just the zone names and pass just the zone name to searches as other portion in the eventtype name is constant. So basically, your dropdown xml would be like this

<input type="dropdown" token="zone_tok">
      <label>Select a Zone</label>
      <default>splunkd</default>
      <choice value="zone1">Zone1</choice>
      <choice value="zone2">Zone2</choice>
    </input>

Your panel searches should be like this

Panel1: eventtype= "host_detection_$zone_tok$" |......

Panel2:  eventtype="vm_detection-$zone_tok$" |....

[alemarzu]

Hi there kiran331,

If you create an eventtype for each zone you'll end up with one value as token for each zone, like this.

eventtypes.conf
[zone1]
search = (eventtype="host-detection_zone1" OR eventtype=vm_detection-zone1")
[zone2]
search = (eventtype="host-detection_zone2" OR eventtype=vm_detection-zone2")

Hope it helps.

[somesoni2]

Could you provide more details? What two values will be passed and from where those two values comes from? How do you want to use those values in your panel searches?

[kiran331]

If i select Zone1 its has to pass "host_detection_zone1" & "vm_detection-zone1" and If i select zone2 it has to pass "host_detection_zone2" & "vm_detection-zone2" to the dashboard with is based on the two searches

eventtype= "host_detection_zone1" |......

eventtype="vm_detection-zone1" |....

If i select zone2 it has to show the results of

eventtype= "host_detection_zone2" |......

eventtype="vm_detection-zone2" |....