Hi there,
I am trying to populate an input text box with an eval case statement - not using the function but simply placing the text for the eval statement in to the text box by using a token. This gets saved in a lookup file and then read using inputlookup to populate the text box with the value in my dash.
EG
<input type="text" token="mytoken" searchWhenChanged="true">
<label>mytoken</label>
<default>"case(dow==\"Mon\",\"dow_Mtwtfss\",true(),\"dow_mTWTFSS\")"</default>
<initialValue>"case(dow==\"Mon\",\"dow_Mtwtfss\",true(),\"dow_mTWTFSS\")"</initialValue>
| eval mytokenoutput="$mytoken$"
|outputlookup bla.csv
The inputlookup command then reads the lookup file token and places that token in the text box - but not if i use "case".
So I have escaped the the case statement to just input the string, but it still doesnt work. If i just put normal text in there - it works. If i do all of this in a search scenario rather than token/dashboard scenario it also works.
Any thoughts ?
Thanks!
try this:
<form>
<label>test_splunkanswers</label>
<fieldset>
<input type="text" token="mytoken" searchWhenChanged="true">
<label>mytoken</label>
<default>case(dow=="Mon","dow_Mtwtfss",true(),"dow_mTWTFSS")</default>
<initialValue>case(dow=="Mon","dow_Mtwtfss",true(),"dow_mTWTFSS")</initialValue>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>|makeresults| eval mytokenoutput=$mytoken$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
i removed all of the escaped double quotes and the double quotes around the string, because you want it to actually eval this in the end, and not treat it as a string.
@cmerriman thanks for getting back to me! The problem is that if I dont escape everything it will not dump it all to the csv file which kinda breaks my dashboard.. Escaping everything works but doesnt make a good default/initial value because obviously it wouldnt run the case statement first time round.