How to Pass A Token value through to another selection of token values

[flynnrya]

Hi,

So I have a dashboard that returns server metrics that has several parameters that I want to search by,

1. APPLICATION that the server operates under
2. ENVIRONMENT that the server operates in (e.g. Production, Dev, Testing)
3. TIME over which I want to search metrics by

What I am looking to add is another drop-down input that allows me to look up servers according their server TYPE (e.g. App Server, Web Server, Database), after choosing token values for the other previously mentioned drop-down inputs. How do I go about making this happen?

[bic]

We had similar issue in recent past , the issue was resolved by passing $value$.
Ex-

$token1$=$token2$ (this is going to take previous set value of token2 as you faced)

instead use $value$

$value$

Hope this helps

[jkat54]

A careful read of this will answer all of your questions:

http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/tokens

But here is a simple example too:

   <input type="dropdown" token="application" searchWhenChanged="true">
     <label>Select an Application</label>
     <choice value="*">All</choice>
     <search>
       <query>index=yourIndex application=*|dedup application | table application</query>
       <earliest>-24h@h</earliest>
       <latest>now</latest>
     </search>
     <fieldForLabel>application</fieldForLabel>
     <fieldForValue>application</fieldForValue>
     <prefix>application="</prefix>
     <suffix>"</suffix>
     <default>*</default>
   </input>
<input type="dropdown" token="environment" searchWhenChanged="true">
     <label>Select an Environment</label>
     <choice value="*">All</choice>
     <search>
       <query>index=yourIndex $application$ environment=* |dedup environment | table environment</query>
       <earliest>-24h@h</earliest>
       <latest>now</latest>
     </search>
     <fieldForLabel>environment</fieldForLabel>
     <fieldForValue>environment</fieldForValue>
     <prefix>environment="</prefix>
     <suffix>"</suffix>
     <default>*</default>
   </input>