Dashboards & Visualizations

Change Choice Text (not value) via Token from search in a checkbox

Software-Simian
Path Finder

Hello,

i am trying to make life easier for my colleagues by providing filtering to error logs.

So i have different types of errors/warnings and want to display the number of the occurrences in the checkbox.

Something like:

<input type="checkbox" token="tok_dummy_6">
  <label>Erroneous Calls ($tok_sum_erroneous$)</label>
  <choice value="yes">Erroneous Calls ($tok_sum_erroneous$)</choice>
  <search>
    <query>
      index=<myIndex> Trace_ID = $tok_traceid$ error_type="Erroneous Call"
      | stats count as Errors
    </query>
    <done>
      <set token="tok_sum_erroneous">$result.Errors$</set>
    </done>

  </search>
</input>

the green part works like a charme, but i really do not like the label as it makes no sense if the checkbox itself is actually stating the same and just putting "yes" seems kinda childish. So i want to delete the label and just go with the text for the choice option.

Any ideas? I tried double $$ with no luck.

 

Kind regards,

Mike

Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="tok_dummy_6">
      <label></label>
      <search>
        <query>
| makeresults
| eval count="Erroneous calls (".tostring(random()%20).")"
| eval value="yes"
| table count value
        </query>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <delimiter> </delimiter>
    </input>

View solution in original post

Software-Simian
Path Finder

Thanks, so basically the same way i fill my dropdowns via search...i could have guessed that :S

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
    <input type="checkbox" token="tok_dummy_6">
      <label></label>
      <search>
        <query>
| makeresults
| eval count="Erroneous calls (".tostring(random()%20).")"
| eval value="yes"
| table count value
        </query>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <delimiter> </delimiter>
    </input>
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...