How to concatenate multiple tokens and set the combined token in drilldown for automatic search

[mandlikarbaaz]

Hi,

I have a requirement to perform end to search for troubleshooting in a dashboard.

I am using multiple tokens inside the dashboard.

Some tokens have a condition to be set or unset depending upon null values.

However, if any of the tokens are not null, then I should concatenate the tokens and pass the combined token to the other sub searches.

Note: There is always a token which is not null

I tried but the other panels always say 'search is waiting for the input'

Below is a sample snippet from the xml dashboard.

<search><query>index=foo</query></search>

<drilldown>

<eval "combined">$token1$. .$token2$. .$token3$. .$token4$. $token5$</eval>

<set "combined_token">$combined$</set>

</drilldown>



<panel>

<search><query>index=abc $combined_token$</query></search>

</panel>

[dural_yyz]

Put "$combined_token$" in the title or description of the first panel.  You can then see what is populating the token you depend upon.  Also I'm curious about your current eval, I would have opted to make the spaces literal characters or only put in a single concatenation character between tokens.

<eval "combined">$token1$. .$token2$. .$token3$. .$token4$. $token5$</eval>
I would try
<eval "combined">$token1$." ".$token2$." ".$token3$." ".$token4$." ".$token5$</eval>
or
<eval "combined">$token1$.$token2$.$token3$.$token4$.$token5$</eval>

[richgalloway]

All tokens in a search must have a non-null value before the search will run.

Try setting the null tokens to empty strings ("") before the search.