Dashboards & Visualizations

Cannot access result.field from input dynamic search results for token

nkleck
New Member

I'm a bit stumped as to why I cannot tokenize $result.<field>$ from a dynamic search that generates dropdown values in an input. Below is an example dashboard I was testing this on. Of note, I cannot wildcard "*" the All and use the wildcard in the token because the underlying search narrowly limits the data returned and a wildcard would expand the follow-on search beyond the results of the dynamic input search.

I've validated the conditionals work in the test dash with the static_tok, which changes with each selection. 

I am attempting to use the dynamic search to create a result that creates OR statements between each value. it would look something like this if "All" dropdown option was selected. Any other dropdown selection should set that value in the token (ie dropdown_tok=buttercup, which works).

test="buttercup" OR test="dash" OR test="fleetfoot" OR test="mcintosh" OR test="mistmane" OR test="rarity" OR test="tenderhoof"

 

This is a dashboard that tests this method:

<form version="1.1" theme="light">
  <label>test</label>
  <fieldset submitButton="false">
    <input type="time" token="timerange1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
        <label>dropdown test</label>
        <choice value="all">All</choice>
        <fieldForLabel>test</fieldForLabel>
        <fieldForValue>test</fieldForValue>
        <search>
          <query>| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test 
| mvexpand test
| eventstats values(test) as mv_test
| eval all_test="test=\"".mvjoin(mv_test, "\" OR test=\"")."\""
| table test,mv_test,all_test
        </query>
          <earliest>$timerange1.earliest$</earliest>
          <latest>$timerange1.latest$</latest>
        </search>
        <change>
          <condition match="$dropdown_tok$ == &quot;all&quot;">
            <set token="dropdown_tok">$result.all_test$</set>
            <set token="all_test">$result.all_test$</set>
            <set token="static_tok">"all_condition"</set>
          </condition>
          <condition match="$dropdown_tok$!=&quot;all&quot;">
            <set token="dropdown_tok">$dropdown_tok|s$</set>
            <set token="static_tok">"not_all_condition"</set>
          </condition>
        </change>
        <default>all</default>
        <initialValue>all</initialValue>
      </input>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <p>dropdown_tok: $dropdown_tok$</p>
        <p>all_test: $all_test$</p>
        <p>static_tok: $static_tok$</p>
      </html>
    </panel>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval dropdown_tok=$dropdown_tok$
| eval static_tok=$static_tok$
| table dropdown_tok,static_tok</query>
          <earliest>$timerange1.earliest$</earliest>
          <latest>$timerange1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...