Dashboards & Visualizations

How to get a text token as an input for dropdown choice value?

Contributor

Hi Everyone,

Simply trying to get addrem token as text value for the dropdown choice value... the value i always get is $addrem$ and not what I enter in the text field. Search String has to remain as $test$ .

         <input type="text" token="addrem" searchWhenChanged="true">
           <label>entrer index</label>
         </input>

         <input type="dropdown" token="test" searchWhenChanged="true">
            <choice value="| stats count | eval test1=&quot;$addrem$&quot;">TEST1</choice>       
            <choice value="| stats count | eval test2=&quot;$addrem$&quot;">TEST2</choice>       

         </input>
       </fieldset>

       <row>
         <panel>
           <table>

             <searchString>$test$</searchString>

           </table>
         </panel>
       </row>
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Choice values in Dropdown input treat data as string hence cannot take tokens. However, you can code Dropdown's change handler to set the search string with existing token. Please try the following:

  <fieldset submitButton="false">
    <input type="text" token="addrem" searchWhenChanged="true">
      <label>entrer index</label>
    </input>
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="test1">TEST1</choice>
      <choice value="test2">TEST2</choice>
      <change>
        <condition value="test1">
          <set token="tok_searchString">| makeresults | eval test1=&quot;$addrem$&quot; | table test1</set>
        </condition>
        <condition value="test2">
          <set token="tok_searchString">| makeresults | eval test2=&quot;$addrem$&quot; | table test2</set>
        </condition>        
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$tok_searchString$</query>
          <earliest>-1s</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Check out Event Handler Reference on Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
PS: Instead of stats count, make use of makeresults command if you are on more recent version of Splunk. Similarly instead of searchString use search with query

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@subtrakt... Were you able to try out answer above? Please let us know if it did not work for you.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Contributor

Yes it worked! Thanks for your time!

0 Karma

SplunkTrust
SplunkTrust

@subtrakt...glad it worked!!! Cheers!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma