Dashboards & Visualizations

Clear input token prefix and suffix for Drilldown use

Contributor

Dear support

I have a simple XML form in which a Dropdown input controls the content of a dashboard table. This dashboard table drills down to another form.
The search on the table is done by matching one field (DB_NAME) by the value of the Dropdown input. This field by itself is not present in the table as a column - it is used for search filter only!

Since the value of this field - although not present in the table - is needed to be send to the other form (by drill down), I tried to use the input's value instead of the missing column, since I know that every record returned has the same DB_NAME.

The Dropdown element is a classic-wizard one, takes values from a search and uses Prefix and Suffix (important!) since db_name values can contain spaces

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search>
        <query>index=omega_ds_idx_01 | DEDUP DB_NAME | FIELDS DB_NAME</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="form.field_scan_run_id"></unset>
      </change>
      <selectFirstChoice>true</selectFirstChoice>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

The drill-down part of the table like:

<drilldown target="blank">
<link>scan_comp_details_01?form.db_name_drill=$field_db_name$&amp;.........</link>
</drilldown>

where:
scancompdetails01 - the drilled form
db
name_drill - text input on the drilled form

PROBLEM:
The dbnamedrill text input is completed with the selected option of the Dropdown input of the calling form,
but the prefix (") and suffix (") are also present.
Thus I see in the dbnamedrill
"database name"
instead of
database name

this damages the search and work in the drilled form scancompdetails_01 !

reminds:
* I need to use prefix-suffix on the original form
* could use hidden simple xml fields, but this is for 6.x only. also no use of .js, just simple xml

Can you please advise how to get the value of the input "stripped" by prefix-suffix on the other side by drill down ?

best regards
Altin

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Set a separate token in the the Dropdown <change> event to be used in the drilldown:

<set token="field_db_name_without_quotes">$value$</set>

Following is updated code, which you can try out:

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
  <label>Database</label>
  <fieldForLabel>DB_NAME</fieldForLabel>
  <fieldForValue>DB_NAME</fieldForValue>
  <search>
    <query>index=omega_ds_idx_01 | DEDUP DB_NAME | FIELDS DB_NAME</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>
  <change>
    <set token="field_db_name_without_quotes">$value$</set>
    <unset token="form.field_scan_run_id"></unset>
  </change>
  <selectFirstChoice>true</selectFirstChoice>
  <prefix>"</prefix>
  <suffix>"</suffix>
</input>

Then use the new token in the drilldown

 <drilldown target="blank">
 <link>scan_comp_details_01?form.db_name_drill=$field_db_name_without_quotes$&amp;.........</link>
 </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Esteemed Legend

The super-sneaky way to do this is to give the "secret" field a name that begins with an underscore ( _ ) which makes it invisible BUT IT IS STILL THERE. Then you just use it when and where you need it but it will never show to the user.

0 Karma

SplunkTrust
SplunkTrust

Set a separate token in the the Dropdown <change> event to be used in the drilldown:

<set token="field_db_name_without_quotes">$value$</set>

Following is updated code, which you can try out:

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
  <label>Database</label>
  <fieldForLabel>DB_NAME</fieldForLabel>
  <fieldForValue>DB_NAME</fieldForValue>
  <search>
    <query>index=omega_ds_idx_01 | DEDUP DB_NAME | FIELDS DB_NAME</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>
  <change>
    <set token="field_db_name_without_quotes">$value$</set>
    <unset token="form.field_scan_run_id"></unset>
  </change>
  <selectFirstChoice>true</selectFirstChoice>
  <prefix>"</prefix>
  <suffix>"</suffix>
</input>

Then use the new token in the drilldown

 <drilldown target="blank">
 <link>scan_comp_details_01?form.db_name_drill=$field_db_name_without_quotes$&amp;.........</link>
 </drilldown>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Contributor

thank you very much for the prompt response, that was it

i was trying in vain with:
$fielddbname$

0 Karma

SplunkTrust
SplunkTrust

Glad it worked 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma