Dashboards & Visualizations

Change Choice Text (not value) via Token from search in a checkbox

Software-Simian
Path Finder

Hello,

i am trying to make life easier for my colleagues by providing filtering to error logs.

So i have different types of errors/warnings and want to display the number of the occurrences in the checkbox.

Something like:

<input type="checkbox" token="tok_dummy_6">
  <label>Erroneous Calls ($tok_sum_erroneous$)</label>
  <choice value="yes">Erroneous Calls ($tok_sum_erroneous$)</choice>
  <search>
    <query>
      index=<myIndex> Trace_ID = $tok_traceid$ error_type="Erroneous Call"
      | stats count as Errors
    </query>
    <done>
      <set token="tok_sum_erroneous">$result.Errors$</set>
    </done>

  </search>
</input>

the green part works like a charme, but i really do not like the label as it makes no sense if the checkbox itself is actually stating the same and just putting "yes" seems kinda childish. So i want to delete the label and just go with the text for the choice option.

Any ideas? I tried double $$ with no luck.

 

Kind regards,

Mike

Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="tok_dummy_6">
      <label></label>
      <search>
        <query>
| makeresults
| eval count="Erroneous calls (".tostring(random()%20).")"
| eval value="yes"
| table count value
        </query>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <delimiter> </delimiter>
    </input>

View solution in original post

Software-Simian
Path Finder

Thanks, so basically the same way i fill my dropdowns via search...i could have guessed that :S

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="tok_dummy_6">
      <label></label>
      <search>
        <query>
| makeresults
| eval count="Erroneous calls (".tostring(random()%20).")"
| eval value="yes"
| table count value
        </query>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <delimiter> </delimiter>
    </input>
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...