Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Cannot access result.field from input dynamic sear...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cannot access result.field from input dynamic search results for token
I'm a bit stumped as to why I cannot tokenize $result.<field>$ from a dynamic search that generates dropdown values in an input. Below is an example dashboard I was testing this on. Of note, I cannot wildcard "*" the All and use the wildcard in the token because the underlying search narrowly limits the data returned and a wildcard would expand the follow-on search beyond the results of the dynamic input search.
I've validated the conditionals work in the test dash with the static_tok, which changes with each selection.
I am attempting to use the dynamic search to create a result that creates OR statements between each value. it would look something like this if "All" dropdown option was selected. Any other dropdown selection should set that value in the token (ie dropdown_tok=buttercup, which works).
test="buttercup" OR test="dash" OR test="fleetfoot" OR test="mcintosh" OR test="mistmane" OR test="rarity" OR test="tenderhoof"
This is a dashboard that tests this method:
<form version="1.1" theme="light">
<label>test</label>
<fieldset submitButton="false">
<input type="time" token="timerange1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
<label>dropdown test</label>
<choice value="all">All</choice>
<fieldForLabel>test</fieldForLabel>
<fieldForValue>test</fieldForValue>
<search>
<query>| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test
| mvexpand test
| eventstats values(test) as mv_test
| eval all_test="test=\"".mvjoin(mv_test, "\" OR test=\"")."\""
| table test,mv_test,all_test
</query>
<earliest>$timerange1.earliest$</earliest>
<latest>$timerange1.latest$</latest>
</search>
<change>
<condition match="$dropdown_tok$ == "all"">
<set token="dropdown_tok">$result.all_test$</set>
<set token="all_test">$result.all_test$</set>
<set token="static_tok">"all_condition"</set>
</condition>
<condition match="$dropdown_tok$!="all"">
<set token="dropdown_tok">$dropdown_tok|s$</set>
<set token="static_tok">"not_all_condition"</set>
</condition>
</change>
<default>all</default>
<initialValue>all</initialValue>
</input>
</panel>
</row>
<row>
<panel>
<html>
<p>dropdown_tok: $dropdown_tok$</p>
<p>all_test: $all_test$</p>
<p>static_tok: $static_tok$</p>
</html>
</panel>
<panel>
<table>
<search>
<query>| makeresults
| eval dropdown_tok=$dropdown_tok$
| eval static_tok=$static_tok$
| table dropdown_tok,static_tok</query>
<earliest>$timerange1.earliest$</earliest>
<latest>$timerange1.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
ATTENTION!! We’re MOVING (not really)
Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions
AppDynamics Summer Webinars
