I have a dropdown input that allows the user to choose from a variety of "result sets"
That drop down is populated by a search that has a field that use for the label, and a field I use for the value. It also has other fields (earliest and latest times) that I want to use in all subsequent charts.
How do I set additional tokens besides the initial fieldForValue
, based on additional fields in my populating search?
Example
<input type="dropdown" token="result_set_id">
<label>Choose a result set</label>
<fieldForLabel>human_name</fieldForLabel>
<fieldForValue>result_set_name</fieldForValue>
<search ref="all_result_sets"></search>
<change>
<set token="human_name_label">$label$</set>
<set token="chart_earliest_time">$result_set_earliest$</set>
</change>
</input>
In this example I have charts that need to use $result_set_id$
, $human_name_label$
and $chart_earliest_time$
the first two work of course, the last one does not.
Seems like a common use case, but I am struggling to make it work.
please help?
thanks
You can use the selected dropdown values and run another search and set token off the search result.
<search>
<query>***your search to fetch result_set_earliest based on token $result_set_id$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<set token="result_set_earliest">$row.result_set_earliest$</set>
</done>
</search>
You can use the selected dropdown values and run another search and set token off the search result.
<search>
<query>***your search to fetch result_set_earliest based on token $result_set_id$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<set token="result_set_earliest">$row.result_set_earliest$</set>
</done>
</search>
thats it! I tried $results.
and $search.
and $job.
but didn't know to try $row.
Thanks. Where is this documented? I searched and searched and could not find it.
Dear splunk: SEO on your documentation sucks. Googling rarely brings up the documentation you need.