How to pass a token from a drop-down input into an eval command in my dashboard search?

[fdi01]

hi.

i have an drop-down field named status with open, closed and inprogess values. like this:

select status
open
closed
inprogess

i want to pass a value of status drop-down input to an eval command in my dashboard search when i click on status value like this:

...|eval status=$status$

how can i do it ??
thank.

[gyslainlatsa · Accepted solution]

hi
try this
...|eval status="$status$"

[fdi01]

thank Mr gyslainlastsa

[jeffland]

You need to set your dropdown to supply the selection into your status-token, for example by setting the "Token" field while editing the dashboard in the web UI or setting token="status" in the input tag in XML.

[jeffland]

Here's an example of working XML code:

...
<panel>
  <input type="dropdown" token="lang" searchWhenChanged="true">
    <search>
      <query>index=twitter | top limit=20 lang</query>
      <earliest>-15m</earliest>
      <latest>now</latest>
    </search>
    <fieldForLabel>lang</fieldForLabel>
    <fieldForValue>lang</fieldForValue>
    <delimiter> OR </delimiter>
  </input>

  <chart>
      <search>
        <query>index=twitter lang=$lang$ | ...</query>
        <earliest>-1d@d</earliest>
        <latest>now</latest>
      </search>
    <option name="charting.chart">bar</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.stackMode">default</option>
    ...

[jeffland]

It should work; did you adjust the searches according to your data?
If you don't want your dropdown to be populated with the possible statuses, you can also supply it with a static selection:

<input type="dropdown" token="status">
    <label>Statuses</label>
    <choice value="open">open</choice>
    <choice value="closed">closed</choice>
    <choice value="inprogress">inprogess</choice>
</input>

[fdi01]

i already created dropdown status.
but i want to take a value of status like
|eval status=$status$
but don't work.

[fdi01]

jeffland thank for you answer but it not correct.
please splunkers i need help.
thank.