Dashboards & Visualizations

How to set a token based on search results?

troyward
Explorer

I have an dropdown input that allows a user to select a user name:

  <fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="DisplayUsername" searchWhenChanged="true">
      <search id="base_0">
        <query>
          | inputlookup users | fields DisplayUsername | dedup DisplayUsername | sort DisplayUsername
        </query>
        <earliest>0</earliest>
      </search>
      <label>User</label>
      <fieldForLabel>DisplayUsername</fieldForLabel>
      <fieldForValue>DisplayUsername</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>

This provides me a token with the users Display Name which I need. But I also need to then get the team that the user belongs to which is in the same lookup table as the initial search. My first idea was to create a new token that is set with the dropdown's Change event like this:

      <change>
        <set token="tok_Team">| inputlookup ctf_users 
          | search DisplayUsername = "Tommy Tiertwo" 
          | fields Team</set>
      </change>

But when I do that, the token is actually set to the search string itself and not the result. Any ideas?

0 Karma
1 Solution

renjith_nair
Legend

@troyward,

Try this and adjust the searches according to your fields and indexes

<form>
  <label>Token Based On Search</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="DisplayUsername">
      <label>DisplayUsername</label>
      <fieldForLabel>DisplayUsername</fieldForLabel>
      <fieldForValue>DisplayUsername</fieldForValue>
      <search>
        <query>| inputlookup users | fields DisplayUsername | dedup DisplayUsername | sort DisplayUsername</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel depends="$this_token_is_not_set_at_anytime$">
      <table>
         <search>
            <query> inputlookup ctf_users| search DisplayUsername="$DisplayUsername$"|fields Team </query>
            <earliest>-15m</earliest>
            <latest>now</latest>            
            <done>
              <set token="Department">$result.Team$</set>
            </done>
        </search>
      </table>
    </panel>
    <panel>
      <title>$DisplayUsername$   : $Department$</title>
      <table>
        <search>
          <query>index="your index" user="$DisplayUsername$" Department="$Department$"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@troyward,

Try this and adjust the searches according to your fields and indexes

<form>
  <label>Token Based On Search</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="DisplayUsername">
      <label>DisplayUsername</label>
      <fieldForLabel>DisplayUsername</fieldForLabel>
      <fieldForValue>DisplayUsername</fieldForValue>
      <search>
        <query>| inputlookup users | fields DisplayUsername | dedup DisplayUsername | sort DisplayUsername</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel depends="$this_token_is_not_set_at_anytime$">
      <table>
         <search>
            <query> inputlookup ctf_users| search DisplayUsername="$DisplayUsername$"|fields Team </query>
            <earliest>-15m</earliest>
            <latest>now</latest>            
            <done>
              <set token="Department">$result.Team$</set>
            </done>
        </search>
      </table>
    </panel>
    <panel>
      <title>$DisplayUsername$   : $Department$</title>
      <table>
        <search>
          <query>index="your index" user="$DisplayUsername$" Department="$Department$"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

woodcock
Esteemed Legend

Line #19 is missing a leading pipe, right?

troyward
Explorer

Worked perfect. Wish there was a cleaner way to do it, but either way...thanks.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...