Dashboards & Visualizations

Can I use a token in the dynamic search option for an input?

klim
Path Finder

I am trying to create a dynamic input using the dynamic search option. Can this search use a token in it? So far I've tried and haven't had any success.

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @klim,

yes, it's possible, but could you share your code (input and search)?

Ciao.

Giuseppe

0 Karma

klim
Path Finder
<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="text" token="field2">
      <label>field2</label>
    </input>
    <input type="multiselect" token="field1">
      <label>field1</label>
      <valuePrefix>index=</valuePrefix>
      <delimiter> OR </delimiter>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>index=* blah=$field2$ | stats count by index</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>test panel</title>
      <table>
        <title></title>
        <search>
          <query>index=$field1$ | stats count by host</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

I have two user input fields. Field2 is populated by text and I want to use the input in that field in the user input field1's dynamic search option.

0 Karma

klim
Path Finder

Actually that example worked for me. 

0 Karma

nadlurinadluri
Communicator

It looks like you might be using the wrong token. This is a sample dashboard which might help you troubleshooting the issue.

<form>
  <label>Dummy</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <choice value="Number1">Number1</choice>
      <choice value="Number2">Number2</choice>
      <default>Number1</default>
      <initialValue>Number1</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Temporary to check the token value - "$field1$"</title>
      <table>
        <search>
          <query>| makeresults 
| eval Key="Number1",Value="11" 
| append 
    [| makeresults 
    | eval Key="Number2",Value="22"
        ] 
| search Key="$field1$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

klim
Path Finder

No that isn't what I'm trying doing. What you provided has a user input that creates a token which is then used in a search to populate a dashboard panel. 

What I want to do is use a token inside a dynamic input that is generated by a search. The token is generated by another user input field.

<input type="multiselect" token="brand" searchWhenChanged="true">
<label>brand</label>
<fieldForLabel>field</fieldForLabel>
<fieldForValue>field</fieldForValue>
<search>
<query>index=* field2=$token$ | table field</query>
<earliest>-1d</earliest>
<latest>now</latest>
</search>
</input>

 

0 Karma

nadlurinadluri
Communicator

Can you share what you have tried?

 

0 Karma

klim
Path Finder

Sure.

I tried a simple search like:

index=* field=$token$ | table field2

That doesn't produce a result. When I click the search button in the input config, the search page that opens contains the same query as above and the token isn't replaced with a value.

However if I put a value in the $token$ spot it returns a value for the input.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...