Can I set tokens from other fields in an input search?

[peterson_wwt]

I have a dropdown input that allows the user to choose from a variety of "result sets"
That drop down is populated by a search that has a field that use for the label, and a field I use for the value. It also has other fields (earliest and latest times) that I want to use in all subsequent charts.

How do I set additional tokens besides the initial fieldForValue, based on additional fields in my populating search?

Example

<input type="dropdown" token="result_set_id">
      <label>Choose a result set</label>
      <fieldForLabel>human_name</fieldForLabel>
      <fieldForValue>result_set_name</fieldForValue>
      <search ref="all_result_sets"></search>
      <change>
          <set token="human_name_label">$label$</set>
         <set token="chart_earliest_time">$result_set_earliest$</set>
      </change>
</input>

In this example I have charts that need to use $result_set_id$, $human_name_label$ and $chart_earliest_time$
the first two work of course, the last one does not.

Seems like a common use case, but I am struggling to make it work.

please help?

thanks

[somesoni2 · Accepted solution]

You can use the selected dropdown values and run another search and set token off the search result.

<search>
          <query>***your search to fetch result_set_earliest based on token $result_set_id$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="result_set_earliest">$row.result_set_earliest$</set>
          </done>
    </search>

[peterson_wwt]

thats it! I tried $results. and $search. and $job. but didn't know to try $row. Thanks. Where is this documented? I searched and searched and could not find it.

Dear splunk: SEO on your documentation sucks. Googling rarely brings up the documentation you need.