Dashboards & Visualizations

Change Choice Text (not value) via Token from search in a checkbox

Software-Simian
Path Finder

Hello,

i am trying to make life easier for my colleagues by providing filtering to error logs.

So i have different types of errors/warnings and want to display the number of the occurrences in the checkbox.

Something like:

<input type="checkbox" token="tok_dummy_6">
  <label>Erroneous Calls ($tok_sum_erroneous$)</label>
  <choice value="yes">Erroneous Calls ($tok_sum_erroneous$)</choice>
  <search>
    <query>
      index=<myIndex> Trace_ID = $tok_traceid$ error_type="Erroneous Call"
      | stats count as Errors
    </query>
    <done>
      <set token="tok_sum_erroneous">$result.Errors$</set>
    </done>

  </search>
</input>

the green part works like a charme, but i really do not like the label as it makes no sense if the checkbox itself is actually stating the same and just putting "yes" seems kinda childish. So i want to delete the label and just go with the text for the choice option.

Any ideas? I tried double $$ with no luck.

 

Kind regards,

Mike

Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="tok_dummy_6">
      <label></label>
      <search>
        <query>
| makeresults
| eval count="Erroneous calls (".tostring(random()%20).")"
| eval value="yes"
| table count value
        </query>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <delimiter> </delimiter>
    </input>

View solution in original post

Software-Simian
Path Finder

Thanks, so basically the same way i fill my dropdowns via search...i could have guessed that :S

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="tok_dummy_6">
      <label></label>
      <search>
        <query>
| makeresults
| eval count="Erroneous calls (".tostring(random()%20).")"
| eval value="yes"
| table count value
        </query>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <delimiter> </delimiter>
    </input>
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...