I don't think you can directly do calculation in HTML, for your requirement can't you do calculation in splunk query and use the result token in html?
Yes! Thanks. I'm not sure if it's the best way or not, and am definitely open to hearing other answers/modifications. This is what I did:
<panel> <search> <query> | makeresults | eval baz=$a$+$b$| table baz </query> <preview> <set token="baz">$result.baz$</set> </preview> </search> <html> <p><b>section title</b></p> <ul> <li> <p>field: <a>$baz$</a></p> </li> </ul> </html> </panel>
You can always hide any panel or table by using depends="$hidden$", for eg:-
will hide the table from displaying.
Thanks once more. For anyone else looking for the answer on this page, @vijeta's comment above references my code before I edited it, where previously I had the query run in a table and was looking for a way to hide it.
Thus, there are two ways of accomplishing the answer to this question: run the query in a table and hide it, or just put your query in the same panel as the html form like I did in my edited comment.
You can do that in SimpleXML using . Where to place the depends on where your tokens come from. In case they come from an input:
<form> <label>Dashboard</label> <fieldset submitButton="false"> <input type="text" token="tok_mem"> <label>Memory</label> <change> <eval token="tok_sum">$tok_mem$ + $tok_swap$</eval> </change> </input> <input type="text" token="tok_swap"> <label>Swap</label> <change> <eval token="tok_sum">$tok_mem$ + $tok_swap$</eval> </change> </input> </fieldset> <row> <panel> <html> <ul> <li> <p>Ram Per Server: $tok_sum$</p> </li> </ul> </html> </panel> </row> </form>
You could do that on Search as well, ... see Splunk>docs on token usage