Dashboards & Visualizations

Change Choice Text (not value) via Token from search in a checkbox

Software-Simian
Path Finder

Hello,

i am trying to make life easier for my colleagues by providing filtering to error logs.

So i have different types of errors/warnings and want to display the number of the occurrences in the checkbox.

Something like:

<input type="checkbox" token="tok_dummy_6">
  <label>Erroneous Calls ($tok_sum_erroneous$)</label>
  <choice value="yes">Erroneous Calls ($tok_sum_erroneous$)</choice>
  <search>
    <query>
      index=<myIndex> Trace_ID = $tok_traceid$ error_type="Erroneous Call"
      | stats count as Errors
    </query>
    <done>
      <set token="tok_sum_erroneous">$result.Errors$</set>
    </done>

  </search>
</input>

the green part works like a charme, but i really do not like the label as it makes no sense if the checkbox itself is actually stating the same and just putting "yes" seems kinda childish. So i want to delete the label and just go with the text for the choice option.

Any ideas? I tried double $$ with no luck.

 

Kind regards,

Mike

Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="tok_dummy_6">
      <label></label>
      <search>
        <query>
| makeresults
| eval count="Erroneous calls (".tostring(random()%20).")"
| eval value="yes"
| table count value
        </query>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <delimiter> </delimiter>
    </input>

View solution in original post

Software-Simian
Path Finder

Thanks, so basically the same way i fill my dropdowns via search...i could have guessed that :S

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="tok_dummy_6">
      <label></label>
      <search>
        <query>
| makeresults
| eval count="Erroneous calls (".tostring(random()%20).")"
| eval value="yes"
| table count value
        </query>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <delimiter> </delimiter>
    </input>
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...