I need to have a dropdown appear and disappear in a dashboard, based on a value of a token which will get set using a search query. Is there a way to accomplish that in simple XML?
Tokens work on field inputs too. Here is an example I threw together. If you set the the "Number of results to make" field to 1, the dropdown will disappear. If you set the field to a number larger than 1, the dropdown will appear.
<form>
<label>Hide Dropdown</label>
<description>If more than result is shown, the "Magic dropdown" will disappear.</description>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="result_count">
<label>Number of results to make:</label>
<default>1</default>
</input>
<input type="dropdown" token="field1" depends="$show_dropdown$">
<label>Magic dropdown:</label>
<choice value="1">1</choice>
<choice value="2">2</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| makeresults count=$result_count$</query>
<done>
<condition match="$job.resultCount$ > 1">
<set token="show_dropdown">true</set>
</condition>
<condition>
<unset token="show_dropdown"></unset>
</condition>
</done>
</search>
</table>
</panel>
</row>
</form>
Tokens work on field inputs too. Here is an example I threw together. If you set the the "Number of results to make" field to 1, the dropdown will disappear. If you set the field to a number larger than 1, the dropdown will appear.
<form>
<label>Hide Dropdown</label>
<description>If more than result is shown, the "Magic dropdown" will disappear.</description>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="result_count">
<label>Number of results to make:</label>
<default>1</default>
</input>
<input type="dropdown" token="field1" depends="$show_dropdown$">
<label>Magic dropdown:</label>
<choice value="1">1</choice>
<choice value="2">2</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| makeresults count=$result_count$</query>
<done>
<condition match="$job.resultCount$ > 1">
<set token="show_dropdown">true</set>
</condition>
<condition>
<unset token="show_dropdown"></unset>
</condition>
</done>
</search>
</table>
</panel>
</row>
</form>
why the following is not working? I made some changes.
<form>
<label>Hide Dropdown</label>
<description>If more than 1 result is shown, the "Magic dropdown" will disappear.</description>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="field1" depends="$show_dropdown$">
<label>Magic dropdown:</label>
<choice value="1">1</choice>
<choice value="2">2</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| rest /services/authentication/current-context splunk_server=local
|stats list(username) as username list(roles) as roles list(defaultApp) as defaultApp
| stats count by roles
| eval territory=substr(roles, 1, 2)
| head 1
| eval ter=case(territory="ad", 2)
</query>
<done>
<condition match="ter > 1">
<set token="show_dropdown">true</set>
</condition>
<condition>
<unset token="show_dropdown"></unset>
</condition>
</done>
</search>
</table>
</panel>
</row>
</form>
Change your condition match to the following:
<condition match="'result.ter' > 1">
<set token="show_dropdown">true</set>
</condition>
Thanks! works like a charm!