Dashboards & Visualizations

Can a token value from one dropdown input be used as part of the choice value statements in a second dropdown?

adamblock2
Path Finder

I am creating a dashboard panel with multiple inputs. I would like to be able to pass a token variable containing the selection from dropdown (1) for use as a value in dropdown (2). The following are the 2 dropdown inputs that I am working on:

<input type="dropdown" token="i_criteria">
        <label>Search Criteria</label>
        <choice value="spamscore">Spam Score</choice>
        <choice value="malwarescore">Malware Score</choice>
        <choice value="phishscore">Phish Score</choice>
      </input>
      <input type="dropdown" token="i_score">
        <label>Criteria Values</label>
        <choice value="$i_criteria$=*">all</choice>
        <choice value="$i_criteria$>0 $i_criteria$<50">1-49</choice>
        <choice value="$i_criteria$>=50 $i_criteria$<100">50-99</choice>
        <choice value="$i_criteria$=100">100</choice>
      </input>

All of the $i_criteria$ values in the second input are being interpreted literally as opposed its actual value being replaced/inserted.

Is there different way that this can be done?

Thank you.

0 Karma
1 Solution

niketn
Legend

@adamblock2, you can do this using the change event of dropdown. Following is an example with condition and set/unset blocks and also $value$ which is one of the default tokens of dropdown.

<input type="dropdown" token="i_criteria" searchWhenChanged="true">
  <label>Search Criteria</label>
  <choice value="spamscore">Spam Score</choice>
  <choice value="malwarescore">Malware Score</choice>
  <choice value="phishscore">Phish Score</choice>
  <change>
    <set token="i_score_string">$value$=*</set>
    <set token="i_score">*</set>
    <set token="form.i_score">*</set>
  </change>
  <default>spamscore</default>
</input>
<input type="dropdown" token="i_score" searchWhenChanged="true">
  <label>Criteria Values</label>
  <choice value="*">all</choice>
  <choice value="49">1-49</choice>
  <choice value="99">50-99</choice>
  <choice value="100">100</choice>
  <change>
    <condition match="$value$==&quot;*&quot;">
      <set token="i_score_string">$i_criteria$=*</set>
    </condition>
    <condition match="$value$==&quot;49&quot;">
      <set token="i_score_string">$i_criteria$>0 $i_criteria$<50</set>
    </condition>
    <condition match="$value$==&quot;99&quot;">
      <set token="i_score_string">$i_criteria$>=50 $i_criteria$<99</set>
    </condition>
    <condition match="$value$==&quot;100&quot;">
      <set token="i_score_string">$i_criteria$=100</set>
    </condition>
  </change>
  <default>*</default>
</input>

Refer to Splunk documentation on
Event Handlers: https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
and Token reference: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TokenReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@adamblock2, you can do this using the change event of dropdown. Following is an example with condition and set/unset blocks and also $value$ which is one of the default tokens of dropdown.

<input type="dropdown" token="i_criteria" searchWhenChanged="true">
  <label>Search Criteria</label>
  <choice value="spamscore">Spam Score</choice>
  <choice value="malwarescore">Malware Score</choice>
  <choice value="phishscore">Phish Score</choice>
  <change>
    <set token="i_score_string">$value$=*</set>
    <set token="i_score">*</set>
    <set token="form.i_score">*</set>
  </change>
  <default>spamscore</default>
</input>
<input type="dropdown" token="i_score" searchWhenChanged="true">
  <label>Criteria Values</label>
  <choice value="*">all</choice>
  <choice value="49">1-49</choice>
  <choice value="99">50-99</choice>
  <choice value="100">100</choice>
  <change>
    <condition match="$value$==&quot;*&quot;">
      <set token="i_score_string">$i_criteria$=*</set>
    </condition>
    <condition match="$value$==&quot;49&quot;">
      <set token="i_score_string">$i_criteria$>0 $i_criteria$<50</set>
    </condition>
    <condition match="$value$==&quot;99&quot;">
      <set token="i_score_string">$i_criteria$>=50 $i_criteria$<99</set>
    </condition>
    <condition match="$value$==&quot;100&quot;">
      <set token="i_score_string">$i_criteria$=100</set>
    </condition>
  </change>
  <default>*</default>
</input>

Refer to Splunk documentation on
Event Handlers: https://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
and Token reference: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TokenReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...