I have two radio tokens generated in a dashboard
Ex.
Token1 Token2
Site 1 Prod
Site 2 Test
Site 3
I want to set a "DBConnection" token based on a combination of the two tokens.
Ex.
Site1 and Prod - DBConnection= Site1ConnectionProd
Site1 and Test - DBConnection = Site1ConnectionTest
Site2 and Prod - DBConnection = Site2ConnectionProd
@Jfilipek you have multiple options to do this:
Option 1) Use tokens from radio input directly in the final query for example. Where tokSite
and tokEnv
are the tokens from the two radio inputs respectively. This option will wait for input values in case Search on Change
is false and Submit
Button is enabled.
"$tokSite$"."Connection"."$tokEnv$"
Option 2) Use the <change>
event handler for each radio to set the required token. Use this approach when each change of radio option needs to set the final token without Submit.
<input type="radio" token="tokSite" searchWhenChanged="true">
<label></label>
<choice value="Site1">Site 1</choice>
<choice value="Site2">Site 2</choice>
<choice value="Site3">Site 3</choice>
<change>
<eval token="tokCombinedOption2">$value$."Connection".$tokEnv$</eval>
</change>
</input>
<input type="radio" token="tokEnv" searchWhenChanged="true">
<label></label>
<choice value="Prod">Prod</choice>
<choice value="Test">Test</choice>
<change>
<eval token="tokCombinedOption2">$tokSite$."Connection".$value$</eval>
</change>
</input>
Option 3) Use Independent search to set combined token. Advantage of this approach would be that in case you have Search on Change
turned on for the radio inputs and Submit button to pass on Tokens to the search.
<!-- Independent Search to Set token -->
<search>
<query>| makeresults
| fields - _time
| eval combinedToken="$tokSite$"."Connection"."$tokEnv$"
</query>
<done>
<set token="tokCombined">$result.combinedToken$</set>
</done>
</search>
Following is a run anywhere example with all three approach:
<form>
<label>Combine Tokens</label>
<!-- Option 3: Independent Search to Set token -->
<search>
<query>| makeresults
| fields - _time
| eval combinedToken="$tokSite$"."Connection"."$tokEnv$"
</query>
<done>
<set token="tokCombinedOption3">$result.combinedToken$</set>
</done>
</search>
<fieldset submitButton="false" autoRun="false">
<input type="radio" token="tokSite" searchWhenChanged="true">
<label></label>
<choice value="Site1">Site 1</choice>
<choice value="Site2">Site 2</choice>
<choice value="Site3">Site 3</choice>
<!-- Option 2: Input Change Event Handler -->
<change>
<eval token="tokCombinedOption2">$value$."Connection".$tokEnv$</eval>
</change>
</input>
<input type="radio" token="tokEnv" searchWhenChanged="true">
<label></label>
<choice value="Prod">Prod</choice>
<choice value="Test">Test</choice>
<!-- Option 2: Input Change Event Handler -->
<change>
<eval token="tokCombinedOption2">$tokSite$."Connection".$value$</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| makeresults
| fields - _time
| eval finalTokenOption1="$tokSite$"."Connection"."$tokEnv$"
| eval finalTokenOption2="$tokCombinedOption2$"
| eval finalTokenOption3="$tokCombinedOption3$"</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
this worked for me thanks
Try using eval token
. Refer this documentation link:
https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting