Dashboards & Visualizations

How to get a text token as an input for dropdown choice value?

subtrakt
Contributor

Hi Everyone,

Simply trying to get addrem token as text value for the dropdown choice value... the value i always get is $addrem$ and not what I enter in the text field. Search String has to remain as $test$ .

         <input type="text" token="addrem" searchWhenChanged="true">
           <label>entrer index</label>
         </input>

         <input type="dropdown" token="test" searchWhenChanged="true">
            <choice value="| stats count | eval test1=&quot;$addrem$&quot;">TEST1</choice>       
            <choice value="| stats count | eval test2=&quot;$addrem$&quot;">TEST2</choice>       

         </input>
       </fieldset>

       <row>
         <panel>
           <table>

             <searchString>$test$</searchString>

           </table>
         </panel>
       </row>
0 Karma
1 Solution

niketn
Legend

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@subtrakt... Were you able to try out answer above? Please let us know if it did not work for you.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

subtrakt
Contributor

Yes it worked! Thanks for your time!

0 Karma

niketn
Legend

@subtrakt...glad it worked!!! Cheers!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...