Dashboards & Visualizations

How can we pass two tokens form one input

sravankaripe
Communicator

i have a use can pass two tokens by using one input type. how can we achieve this.
Please help me with sample Xml code

0 Karma

woodcock
Esteemed Legend

You can put your values for origToken between a separator string such as :: (e.g. index=abc sourcetype=abc::index=xyz sourcetype=xyz) and then use XML like this:

<selection>
   <eval token="derivedToken1">replace($origToken$, ".*::", "")</eval>
   <eval token="derivedToken2">replace($origToken$, "::.*", "")</eval>
</selection>

paulbannister
Communicator

As a workaround you could create a base search within the dashboard that generates the second token utilising the first token from the input, that way you would have both tokens available within the XML, however as above more details would be needed to give a full answer (Type of input, desired outcome, etc..) Would you be able to post a example of the dashboard/reports/XML?

0 Karma

woodcock
Esteemed Legend

You can encode both values in the value by setting the values to something like this index=xxx sourcetype=yyy and then use the combined KVP in your search like this:

<query>$MyDualKVP$ | stats count by host</query>

So do you really need 2 tokens?

0 Karma

niketn
Legend

@sravankaripe... You need to add more details. What is the input that you are using what are the values(fields) that you need to pass? Also what is the search/search results?

You should be able to code inputs change event to pass on the values you need.
http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sravankaripe
Communicator

Input type is Dropdown.
this dropdown should have two tokens.
1st token will go to first panel (say index= abc sourcetype=abc:abc $token1$)
2nd token will goes to second panel in the same dashboard.(say index=xyz sourcetype=xyz:xyz $token2$)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...