Solved: Re: Fetch additional Tokens in Dropdown to populat...

rangarbus · ‎10-04-2020

lookup_file.csv has the data as below
dId,count,perc

Usecase : User to select dropdown based on lookup dId field. Once select, I want to populate count and perc for that dId selected as a html text.
So that user known the count and perc for the dropdown selected dId

<panel>
  <input type="dropdown" token="lookup_Id" searchWhenChanged="true">
    <label>Select ID</label>
    <fieldForLabel>id</fieldForLabel>
    <fieldForValue>dId</fieldForValue>
    <search>
      <query>| inputlookup lookup_file.csv</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <prefix>"</prefix>
    <suffix>"</suffix>
    <change>
      <condition value="$lookup_Id$">
         <set token="count"><query>|inputlookup lookup_file.csv | where dId="$lookup_Id$" | table count</query></set>
         <set token="perc"><query>|inputlookup lookup_file.csv | where dId="$lookup_Id$" | table perc</query></set>
       </condition>
    </change>
  </input>
  <html>
   <i>$lookup_Id$: Count is $count$, Percentage is $perc$</i>
  </html>  
</panel>

Currenlty i get

Meaning the dId is populated correctly, but other 2 tokens under change/condition is not not evaluating rather printed as-is query string.

Please help me on this.

niketn · ‎10-04-2020

@rangarbus you may have two options to do this.

Option 1: Populate Count an Perc suffixed to the existing dropdown value did and use <eval> to set required tokens.

Option 2: Run an independent search which processes the value of did and sets required tokens count and percentage.

In either case first improve the performance of your Dropdown by running an optimized search. As of now you may not see the issue in case you have less rows and columns but your performance issues for Dropdown loading and overall dashboard will aggravate as records increase.

Following is a run anywhere example showcasing both example using a dummy search to mimic inputlookup data similar to your use case.

Following is the required Simple XML code which you can adjust as per your actual use case/code.

<form>
  <label>Dropdown with multiple Tokens</label>
  <fieldset submitButton="false"></fieldset>
  <!-- TEST ONLY - token to mimic inputlookup scenario-->
  <init>
    <set token="inputLookup_LookupFile">makeresults count=3
| fields - _time
| streamstats count as sno
| eval id=sno, dId="ABC-".sno, count=substr(tostring(random()),1,2)
| eventstats sum(count) as Total
| eval perc=round((count/Total)*100,1)</set>
  </init>
  <!-- Independent Search to Set multiple tokens based on Dropdown value -->
  <search>
    <query>| $inputLookup_LookupFile$ 
    | search dId="$lookup_Id2$"
    | fields dId count perc
    </query>
    <done>
      <set token="count2">$result.count$</set>
      <set token="perc2">$result.perc$</set>
    </done>
  </search>
  <row>
    <panel>
      <title>Option 1 : Using eval to set token from Dropdown change event handler</title>
      <input type="dropdown" token="lookup_Id1" searchWhenChanged="true">
        <label>Select ID</label>
        <fieldForLabel>id</fieldForLabel>
        <fieldForValue>value</fieldForValue>
        <search>
          <query>| $inputLookup_LookupFile$
| fields id dId count perc
| eval value=dId."|".count."|".perc
| table id value</query>
        </search>
        <change>
          <eval token="dId1">mvindex(split($value$,"|"),0)</eval>
          <eval token="count1">mvindex(split($value$,"|"),1)</eval>
          <eval token="perc1">mvindex(split($value$,"|"),2)</eval>
        </change>
      </input>
      <html>
        <div>
          <div>lookup_Id1: $lookup_Id1$</div>
          <div>dId1: $dId1$</div>
          <div>count1: $count1$</div>
          <div>perc1: $perc1$</div>
        </div>
      </html>
    </panel>
    <panel>
      <title>Option 2 : Using independent search to set token from Dropdown value token</title>
      <input type="dropdown" token="lookup_Id2" searchWhenChanged="true">
        <label>Select ID</label>
        <fieldForLabel>id</fieldForLabel>
        <fieldForValue>dId</fieldForValue>
        <search>
          <query>| $inputLookup_LookupFile$
| fields id dId</query>
        </search>
      </input>
      <html>
        <div>
          <div>lookup_Id2: $lookup_Id2$</div>
          <div>dId2: $lookup_Id2$</div>
          <div>count2: $count2$</div>
          <div>perc2: $perc2$</div>
        </div>
      </html>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎10-04-2020

@rangarbus you may have two options to do this.

Option 1: Populate Count an Perc suffixed to the existing dropdown value did and use <eval> to set required tokens.

Option 2: Run an independent search which processes the value of did and sets required tokens count and percentage.

In either case first improve the performance of your Dropdown by running an optimized search. As of now you may not see the issue in case you have less rows and columns but your performance issues for Dropdown loading and overall dashboard will aggravate as records increase.

Following is a run anywhere example showcasing both example using a dummy search to mimic inputlookup data similar to your use case.

Following is the required Simple XML code which you can adjust as per your actual use case/code.

<form>
  <label>Dropdown with multiple Tokens</label>
  <fieldset submitButton="false"></fieldset>
  <!-- TEST ONLY - token to mimic inputlookup scenario-->
  <init>
    <set token="inputLookup_LookupFile">makeresults count=3
| fields - _time
| streamstats count as sno
| eval id=sno, dId="ABC-".sno, count=substr(tostring(random()),1,2)
| eventstats sum(count) as Total
| eval perc=round((count/Total)*100,1)</set>
  </init>
  <!-- Independent Search to Set multiple tokens based on Dropdown value -->
  <search>
    <query>| $inputLookup_LookupFile$ 
    | search dId="$lookup_Id2$"
    | fields dId count perc
    </query>
    <done>
      <set token="count2">$result.count$</set>
      <set token="perc2">$result.perc$</set>
    </done>
  </search>
  <row>
    <panel>
      <title>Option 1 : Using eval to set token from Dropdown change event handler</title>
      <input type="dropdown" token="lookup_Id1" searchWhenChanged="true">
        <label>Select ID</label>
        <fieldForLabel>id</fieldForLabel>
        <fieldForValue>value</fieldForValue>
        <search>
          <query>| $inputLookup_LookupFile$
| fields id dId count perc
| eval value=dId."|".count."|".perc
| table id value</query>
        </search>
        <change>
          <eval token="dId1">mvindex(split($value$,"|"),0)</eval>
          <eval token="count1">mvindex(split($value$,"|"),1)</eval>
          <eval token="perc1">mvindex(split($value$,"|"),2)</eval>
        </change>
      </input>
      <html>
        <div>
          <div>lookup_Id1: $lookup_Id1$</div>
          <div>dId1: $dId1$</div>
          <div>count1: $count1$</div>
          <div>perc1: $perc1$</div>
        </div>
      </html>
    </panel>
    <panel>
      <title>Option 2 : Using independent search to set token from Dropdown value token</title>
      <input type="dropdown" token="lookup_Id2" searchWhenChanged="true">
        <label>Select ID</label>
        <fieldForLabel>id</fieldForLabel>
        <fieldForValue>dId</fieldForValue>
        <search>
          <query>| $inputLookup_LookupFile$
| fields id dId</query>
        </search>
      </input>
      <html>
        <div>
          <div>lookup_Id2: $lookup_Id2$</div>
          <div>dId2: $lookup_Id2$</div>
          <div>count2: $count2$</div>
          <div>perc2: $perc2$</div>
        </div>
      </html>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

rangarbus · ‎10-05-2020

Option 1 - For some reason, did not return the tokens rather returned null.

Option 2 - Worked very well . Thank you so much!

rangarbus · ‎10-04-2020

Thanks. Is there any solution option to get the additional columns from inputlookup based on dropdown choice selected into tokens, so that i can use that on HTML text.?

richgalloway · ‎10-04-2020

Unfortunately, one cannot put a <query> tag anywhere in a dashboard's code to run a search. The <query> tag is valid only within a <search>, which (in this context) can only be used to populate input choices.

---
If this reply helps you, Karma would be appreciated.

Fetch additional Tokens in Dropdown to populate a HTML user text

form

panel

token

.conf24 | Registration Open!

ICYMI - Check out the latest releases of Splunk Edge Processor

Introducing the 2024 SplunkTrust!