Dashboards & Visualizations

Clear input token prefix and suffix for Drilldown use

altink
Builder

Dear support

I have a simple XML form in which a Dropdown input controls the content of a dashboard table. This dashboard table drills down to another form.
The search on the table is done by matching one field (DB_NAME) by the value of the Dropdown input. This field by itself is not present in the table as a column - it is used for search filter only!

Since the value of this field - although not present in the table - is needed to be send to the other form (by drill down), I tried to use the input's value instead of the missing column, since I know that every record returned has the same DB_NAME.

The Dropdown element is a classic-wizard one, takes values from a search and uses Prefix and Suffix (important!) since db_name values can contain spaces

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search>
        <query>index=omega_ds_idx_01 | DEDUP DB_NAME | FIELDS DB_NAME</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="form.field_scan_run_id"></unset>
      </change>
      <selectFirstChoice>true</selectFirstChoice>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

The drill-down part of the table like:

<drilldown target="blank">
<link>scan_comp_details_01?form.db_name_drill=$field_db_name$&amp;.........</link>
</drilldown>

where:
scan_comp_details_01 - the drilled form
db_name_drill - text input on the drilled form

PROBLEM:
The db_name_drill text input is completed with the selected option of the Dropdown input of the calling form,
but the prefix (") and suffix (") are also present.
Thus I see in the db_name_drill
"database name"
instead of
database name

this damages the search and work in the drilled form scan_comp_details_01 !

reminds:
* I need to use prefix-suffix on the original form
* could use hidden simple xml fields, but this is for 6.x only. also no use of .js, just simple xml

Can you please advise how to get the value of the input "stripped" by prefix-suffix on the other side by drill down ?

best regards
Altin

0 Karma
1 Solution

niketn
Legend

Set a separate token in the the Dropdown <change> event to be used in the drilldown:

<set token="field_db_name_without_quotes">$value$</set>

Following is updated code, which you can try out:

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
  <label>Database</label>
  <fieldForLabel>DB_NAME</fieldForLabel>
  <fieldForValue>DB_NAME</fieldForValue>
  <search>
    <query>index=omega_ds_idx_01 | DEDUP DB_NAME | FIELDS DB_NAME</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>
  <change>
    <set token="field_db_name_without_quotes">$value$</set>
    <unset token="form.field_scan_run_id"></unset>
  </change>
  <selectFirstChoice>true</selectFirstChoice>
  <prefix>"</prefix>
  <suffix>"</suffix>
</input>

Then use the new token in the drilldown

 <drilldown target="blank">
 <link>scan_comp_details_01?form.db_name_drill=$field_db_name_without_quotes$&amp;.........</link>
 </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

The super-sneaky way to do this is to give the "secret" field a name that begins with an underscore ( _ ) which makes it invisible BUT IT IS STILL THERE. Then you just use it when and where you need it but it will never show to the user.

0 Karma

niketn
Legend

Set a separate token in the the Dropdown <change> event to be used in the drilldown:

<set token="field_db_name_without_quotes">$value$</set>

Following is updated code, which you can try out:

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
  <label>Database</label>
  <fieldForLabel>DB_NAME</fieldForLabel>
  <fieldForValue>DB_NAME</fieldForValue>
  <search>
    <query>index=omega_ds_idx_01 | DEDUP DB_NAME | FIELDS DB_NAME</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>
  <change>
    <set token="field_db_name_without_quotes">$value$</set>
    <unset token="form.field_scan_run_id"></unset>
  </change>
  <selectFirstChoice>true</selectFirstChoice>
  <prefix>"</prefix>
  <suffix>"</suffix>
</input>

Then use the new token in the drilldown

 <drilldown target="blank">
 <link>scan_comp_details_01?form.db_name_drill=$field_db_name_without_quotes$&amp;.........</link>
 </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

altink
Builder

thank you very much for the prompt response, that was it

i was trying in vain with:
$field_db_name$

0 Karma

niketn
Legend

Glad it worked 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...