Dashboards & Visualizations

How to get a text token as an input for dropdown choice value?

subtrakt
Contributor

Hi Everyone,

Simply trying to get addrem token as text value for the dropdown choice value... the value i always get is $addrem$ and not what I enter in the text field. Search String has to remain as $test$ .

         <input type="text" token="addrem" searchWhenChanged="true">
           <label>entrer index</label>
         </input>

         <input type="dropdown" token="test" searchWhenChanged="true">
            <choice value="| stats count | eval test1=&quot;$addrem$&quot;">TEST1</choice>       
            <choice value="| stats count | eval test2=&quot;$addrem$&quot;">TEST2</choice>       

         </input>
       </fieldset>

       <row>
         <panel>
           <table>

             <searchString>$test$</searchString>

           </table>
         </panel>
       </row>
0 Karma
1 Solution

niketn
Legend

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@subtrakt... Were you able to try out answer above? Please let us know if it did not work for you.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

subtrakt
Contributor

Yes it worked! Thanks for your time!

0 Karma

niketn
Legend

@subtrakt...glad it worked!!! Cheers!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...