Dashboards & Visualizations

How to get a text token as an input for dropdown choice value?

subtrakt
Contributor

Hi Everyone,

Simply trying to get addrem token as text value for the dropdown choice value... the value i always get is $addrem$ and not what I enter in the text field. Search String has to remain as $test$ .

         <input type="text" token="addrem" searchWhenChanged="true">
           <label>entrer index</label>
         </input>

         <input type="dropdown" token="test" searchWhenChanged="true">
            <choice value="| stats count | eval test1=&quot;$addrem$&quot;">TEST1</choice>       
            <choice value="| stats count | eval test2=&quot;$addrem$&quot;">TEST2</choice>       

         </input>
       </fieldset>

       <row>
         <panel>
           <table>

             <searchString>$test$</searchString>

           </table>
         </panel>
       </row>
0 Karma
1 Solution

niketn
Legend

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@subtrakt... Were you able to try out answer above? Please let us know if it did not work for you.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

subtrakt
Contributor

Yes it worked! Thanks for your time!

0 Karma

niketn
Legend

@subtrakt...glad it worked!!! Cheers!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...