I am creating a dashboard panel with multiple inputs. I would like to be able to pass a token variable containing the selection from dropdown (1) for use as a value in dropdown (2). The following are the 2 dropdown inputs that I am working on:
<input type="dropdown" token="i_criteria">
<label>Search Criteria</label>
<choice value="spamscore">Spam Score</choice>
<choice value="malwarescore">Malware Score</choice>
<choice value="phishscore">Phish Score</choice>
</input>
<input type="dropdown" token="i_score">
<label>Criteria Values</label>
<choice value="$i_criteria$=*">all</choice>
<choice value="$i_criteria$>0 $i_criteria$<50">1-49</choice>
<choice value="$i_criteria$>=50 $i_criteria$<100">50-99</choice>
<choice value="$i_criteria$=100">100</choice>
</input>
All of the $i_criteria$
values in the second input are being interpreted literally as opposed its actual value being replaced/inserted.
Is there different way that this can be done?
Thank you.
@adamblock2, you can do this using the change event of dropdown. Following is an example with condition and set/unset blocks and also $value$ which is one of the default tokens of dropdown.
<input type="dropdown" token="i_criteria" searchWhenChanged="true">
<label>Search Criteria</label>
<choice value="spamscore">Spam Score</choice>
<choice value="malwarescore">Malware Score</choice>
<choice value="phishscore">Phish Score</choice>
<change>
<set token="i_score_string">$value$=*</set>
<set token="i_score">*</set>
<set token="form.i_score">*</set>
</change>
<default>spamscore</default>
</input>
<input type="dropdown" token="i_score" searchWhenChanged="true">
<label>Criteria Values</label>
<choice value="*">all</choice>
<choice value="49">1-49</choice>
<choice value="99">50-99</choice>
<choice value="100">100</choice>
<change>
<condition match="$value$=="*"">
<set token="i_score_string">$i_criteria$=*</set>
</condition>
<condition match="$value$=="49"">
<set token="i_score_string">$i_criteria$>0 $i_criteria$<50</set>
</condition>
<condition match="$value$=="99"">
<set token="i_score_string">$i_criteria$>=50 $i_criteria$<99</set>
</condition>
<condition match="$value$=="100"">
<set token="i_score_string">$i_criteria$=100</set>
</condition>
</change>
<default>*</default>
</input>
Refer to Splunk documentation on
Event Handlers: https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
and Token reference: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TokenReference
@adamblock2, you can do this using the change event of dropdown. Following is an example with condition and set/unset blocks and also $value$ which is one of the default tokens of dropdown.
<input type="dropdown" token="i_criteria" searchWhenChanged="true">
<label>Search Criteria</label>
<choice value="spamscore">Spam Score</choice>
<choice value="malwarescore">Malware Score</choice>
<choice value="phishscore">Phish Score</choice>
<change>
<set token="i_score_string">$value$=*</set>
<set token="i_score">*</set>
<set token="form.i_score">*</set>
</change>
<default>spamscore</default>
</input>
<input type="dropdown" token="i_score" searchWhenChanged="true">
<label>Criteria Values</label>
<choice value="*">all</choice>
<choice value="49">1-49</choice>
<choice value="99">50-99</choice>
<choice value="100">100</choice>
<change>
<condition match="$value$=="*"">
<set token="i_score_string">$i_criteria$=*</set>
</condition>
<condition match="$value$=="49"">
<set token="i_score_string">$i_criteria$>0 $i_criteria$<50</set>
</condition>
<condition match="$value$=="99"">
<set token="i_score_string">$i_criteria$>=50 $i_criteria$<99</set>
</condition>
<condition match="$value$=="100"">
<set token="i_score_string">$i_criteria$=100</set>
</condition>
</change>
<default>*</default>
</input>
Refer to Splunk documentation on
Event Handlers: https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
and Token reference: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TokenReference