How to get a text token as an input for dropdown choice value?

[subtrakt]

Hi Everyone,

Simply trying to get addrem token as text value for the dropdown choice value... the value i always get is $addrem$ and not what I enter in the text field. Search String has to remain as $test$ .

         <input type="text" token="addrem" searchWhenChanged="true">
           <label>entrer index</label>
         </input>

         <input type="dropdown" token="test" searchWhenChanged="true">
            <choice value="| stats count | eval test1=&quot;$addrem$&quot;">TEST1</choice>       
            <choice value="| stats count | eval test2=&quot;$addrem$&quot;">TEST2</choice>       

         </input>
       </fieldset>

       <row>
         <panel>
           <table>

             <searchString>$test$</searchString>

           </table>
         </panel>
       </row>

[niketn · Accepted solution]

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

[niketn]

@subtrakt... Were you able to try out answer above? Please let us know if it did not work for you.

[subtrakt]

Yes it worked! Thanks for your time!

[niketn]

@subtrakt...glad it worked!!! Cheers!