Dashboards & Visualizations

How to get dashboard token value from input to another input?

igne
Observer

I've got a dashboard where i want to append multiple searches together based on checkbox inputs, but the variables aren't resolving?  I can get conditional tokens to set the entire firewall_search string,  but I don't want to have to setup all the available options if i can just get the variables to use their value instead of the variable.
Summary - I am asking for $src_ip$ and then trying to use that in a checkbox token value, nested in another variable, but it doesn't resolve the nested variable, and instead i just get the $src_ip$ name
example xml
<input type="text" token="src_ip">
  <label>Source IP</label>
</input>
<input type="checkbox" token="firewall_search">
  <label>Firewalls</label>
  <choice value="append [search index=index1 src_ip=$src_ip$  other_specific_search_Stuff_to_index1 ]">firewall 1</choice>
<choice value="append [search index=index2 src_ip=$src_ip$  searches_different_from_1 ]">firewall 2</choice>
<delimiter> | </delimiter>
</input>
</fieldset>
<row>
<panel>
<title>dependent search</title>
<table>
<search>
<query>$firewall_search$ | stats count by index, src_ip, otherfields</query>
<earliest>$time_pick.earliest$</earliest>
<latest>$time_pick.latest$</latest>
</search>

When i run that, $firewall_search$ resolves to the choice value listed, but doesn't resolve $src_ip$ to the value set in the form

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this

    <input type="checkbox" token="firewall_search">
      <label>Firewalls</label>
      <choice value="search index=index1 other_specific_search_Stuff_to_index1">firewall 1</choice>
      <choice value="search index=index2 searches_different_from_1">firewall 2</choice>
      <valuePrefix>| append [ </valuePrefix>
      <delimiter> </delimiter>
      <valueSuffix> src_ip=$src_ip$ ]</valueSuffix>
    </input>
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...