Dashboards & Visualizations

How to pass a token from a drop-down input into an eval command in my dashboard search?

fdi01
Motivator

hi.

i have an drop-down field named status with open, closed and inprogess values. like this:

select status
open
closed
inprogess

i want to pass a value of status drop-down input to an eval command in my dashboard search when i click on status value like this:

...|eval status=$status$

how can i do it ??
thank.

1 Solution

gyslainlatsa
Motivator

hi
try this
...|eval status="$status$"

View solution in original post

gyslainlatsa
Motivator

hi
try this
...|eval status="$status$"

fdi01
Motivator

thank Mr gyslainlastsa

0 Karma

jeffland
SplunkTrust
SplunkTrust

You need to set your dropdown to supply the selection into your status-token, for example by setting the "Token" field while editing the dashboard in the web UI or setting token="status" in the input tag in XML.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Here's an example of working XML code:

...
<panel>
  <input type="dropdown" token="lang" searchWhenChanged="true">
    <search>
      <query>index=twitter | top limit=20 lang</query>
      <earliest>-15m</earliest>
      <latest>now</latest>
    </search>
    <fieldForLabel>lang</fieldForLabel>
    <fieldForValue>lang</fieldForValue>
    <delimiter> OR </delimiter>
  </input>

  <chart>
      <search>
        <query>index=twitter lang=$lang$ | ...</query>
        <earliest>-1d@d</earliest>
        <latest>now</latest>
      </search>
    <option name="charting.chart">bar</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.stackMode">default</option>
    ...
0 Karma

jeffland
SplunkTrust
SplunkTrust

It should work; did you adjust the searches according to your data?
If you don't want your dropdown to be populated with the possible statuses, you can also supply it with a static selection:

<input type="dropdown" token="status">
    <label>Statuses</label>
    <choice value="open">open</choice>
    <choice value="closed">closed</choice>
    <choice value="inprogress">inprogess</choice>
</input>
0 Karma

fdi01
Motivator

i already created dropdown status.
but i want to take a value of status like
|eval status=$status$
but don't work.

0 Karma

fdi01
Motivator

jeffland thank for you answer but it not correct.
please splunkers i need help.
thank.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...