Solved: Re: How to set token by comparing values of other ...

qbolbk59 · ‎08-23-2019

I have a dashboard which sets couple of tokens and passes the token to next dashboard on user click.
I want to compare the value of one of the token (say token_master) with specific string and if it's true it should set another token. snippet of my XML is given below:

<init>
    <condition match="$master_token$=='Data Entry'">
      <set token="data_entry">True</set>
      <unset token="attachment"></unset>
      <unset token="click_only"></unset>
    </condition>

    <condition match="$master_token$=='Click Only'">
      <set token="click_only">True</set>
      <unset token="data_entry"></unset>
      <unset token="attachment"></unset>

    </condition>

    <condition match="$master_token$=='Attachment'">
      <set token="attachment">True</set>
      <unset token="click_only"></unset>
      <unset token="data_entry"></unset>
    </condition>

      </init>

However, somehow, it's not setting the other 3 tokens that i want. Not sure if the issue is with the value comparison, or at the token setting.

niketn · ‎08-23-2019

@qbolbk59 while your question does not describe where/when is the master_token is set, as far as master_token is set the following independent search would be able to set the remaining tokens as needed.

In the following run anywhere example I am using init section to set the master_token but in actual code it can be anywhere either in the same dashboard or coming from a different dashboard, as the independent search to set the remaining tokens will run only after the master_token is set. Please try out and confirm!

<dashboard>
  <label>Set token on load</label>
  <init>
    <set token="master_token">Data Entry</set>
  </init>
  <search>
    <query>
      | makeresults
      | fields - _time
      | eval master_token="$master_token$"
    </query>
    <progress>
       <condition match="$master_token$==&quot;Data Entry&quot;">
         <set token="data_entry">True</set>
         <unset token="attachment"></unset>
         <unset token="click_only"></unset>
       </condition>
       <condition match="$master_token$==&quot;Click Only&quot;">
         <set token="click_only">True</set>
         <unset token="data_entry"></unset>
         <unset token="attachment"></unset>
       </condition>
       <condition match="$master_token$==&quot;Attachment&quot;">
         <set token="attachment">True</set>
         <unset token="click_only"></unset>
         <unset token="data_entry"></unset>
       </condition>
     </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>master_token: $master_token$</div>
        <div>data_entry: $data_entry$</div>
        <div>click_only: $click_only$</div>
        <div>data_entry: $attachment$</div>
      </html>
    </panel>
  </row>
</dashboard>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎08-23-2019

@qbolbk59 while your question does not describe where/when is the master_token is set, as far as master_token is set the following independent search would be able to set the remaining tokens as needed.

In the following run anywhere example I am using init section to set the master_token but in actual code it can be anywhere either in the same dashboard or coming from a different dashboard, as the independent search to set the remaining tokens will run only after the master_token is set. Please try out and confirm!

<dashboard>
  <label>Set token on load</label>
  <init>
    <set token="master_token">Data Entry</set>
  </init>
  <search>
    <query>
      | makeresults
      | fields - _time
      | eval master_token="$master_token$"
    </query>
    <progress>
       <condition match="$master_token$==&quot;Data Entry&quot;">
         <set token="data_entry">True</set>
         <unset token="attachment"></unset>
         <unset token="click_only"></unset>
       </condition>
       <condition match="$master_token$==&quot;Click Only&quot;">
         <set token="click_only">True</set>
         <unset token="data_entry"></unset>
         <unset token="attachment"></unset>
       </condition>
       <condition match="$master_token$==&quot;Attachment&quot;">
         <set token="attachment">True</set>
         <unset token="click_only"></unset>
         <unset token="data_entry"></unset>
       </condition>
     </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>master_token: $master_token$</div>
        <div>data_entry: $data_entry$</div>
        <div>click_only: $click_only$</div>
        <div>data_entry: $attachment$</div>
      </html>
    </panel>
  </row>
</dashboard>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

qbolbk59 · ‎08-26-2019

Hi @niketn ,

The master_token is set on a different dashboard. The token is passed to the current dashboard when clicked on a table row. I checked and the master_token is indeed being sent successfully on the current dashboard. So that's not a problem now.

The situation is that the master_token may have three values i.e., "Data Entry", "attachment" and "Click Only". Now on my current dashboard, i want to load some specific panels based on the value of the master token. And hence i want to compare the values and based on the value of master token, i am setting new tokens.

These token will then be used to load specific panels, if set. Hope i am clear with my requirement now. 🙂

Sukisen1981 · ‎08-26-2019

hi @qbolbk59
How are you passing the master token in your first dashboard, something like this?

<set token="master_token">$click.value2$</set>

If your master token gets captured in the second dashboard you can use @niketnilay or my solution.

niketn · ‎08-26-2019

@qbolbk59 since you are passing token from other dashboard to this one, either one of the solution should work. Having said that, my answer would work in either case. The moment master_token gets value or its value changes, the independent search will fire and hence required token would be set. You need to incorporate the independent search (i.e. search without a view only used to set required token/s through search event handler) as per your needs in your existing dashboard.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

qbolbk59 · ‎08-29-2019

Hi @niketnilay ,

the solution you proposed worked for me. Although the search tag is not doing anything for me. So i am just using it to make the progress tag valid. But anyways, it works for me now.
Thanks a lot !
Cheers !!!

niketn · ‎08-29-2019

Yes the independent search is used to handle the value and set subsequent token to be used in actual search. It is a dummy search but required. Glad you found the solution working.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

yuanliu · ‎05-29-2022

This dummy search method saved my day in a slightly different use case: Direct URL link to input token. Basically, I need to set a token based on an input value, and want the input to have an initial value. Without the dummy search-<progress/>, I have to set the token value in <init/> based on the initial/default value of input. As such, if I use a URL link that corresponds to input that is not the default input, the result is bizarre because the token value would still correspond to default input.

After some trial and error, I get this dashboard to work both interactively and by direct link to any input value. (I have to remove the <init/> segment to make it work.)

<form>
  <label>Set token on load</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="master_token" searchWhenChanged="true">
      <label>master token</label>
      <choice value="Data Entry">Data entry</choice>
      <choice value="Click Only">Click only</choice>
      <choice value="Attachment">Attachment</choice>
      <default>Data Entry</default>
    </input>
  </fieldset>
  <search>
    <query>
      | makeresults
      | fields - _time
      | eval master_token="$master_token$"
    </query>
    <progress>
      <condition match="master_token==&quot;Data Entry&quot;">
        <set token="data_entry">True</set>
        <unset token="attachment"></unset>
        <unset token="click_only"></unset>
      </condition>
      <condition match="master_token==&quot;Click Only&quot;">
        <set token="click_only">True</set>
        <unset token="data_entry"></unset>
        <unset token="attachment"></unset>
      </condition>
      <condition match="master_token==&quot;Attachment&quot;">
        <set token="attachment">True</set>
        <unset token="click_only"></unset>
        <unset token="data_entry"></unset>
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>master_token: $master_token$</div>
        <div>data_entry: $data_entry$</div>
        <div>click_only: $click_only$</div>
        <div>attachment: $attachment$</div>
      </html>
    </panel>
  </row>
</form>

In the above, default input is "Data Entry". If I link to /set_token_on_load?form.master_token=Click%20Only, the output will be

master_token: Click Only

data_entry: $data_entry$

click_only: True

attachment: $attachment$

instead of the bizarre

master_token: Click Only

data_entry: Data Entry

click_only: $click_only$

attachment: $attachment$

if I had to set these subtokens in <init/>.

I didn't know that you can put a search outside panels. Thanks for the eyeopener, @niketn!

Sukisen1981 · ‎08-23-2019

hi @qbolbk59

where are you setting the master_token value in the first place, probably just above the conditions under init?
if you remove your conditions the token will get set.
Now, why dont you have a dummy hidden search AFTER your init token is set, and play around with the token setttings for your 3 other tokens there?
something like this

 <form>
       <label>wwww</label>
      <init>

         <set token="app_name">true</set>


      </init>
      <row>
      <panel>
        <table>
      <search>
              <query>|makeresults | eval x="$app_name$"|table x</query>
              <earliest>0</earliest>
              <latest>now</latest>
            </search>
            </table>
        </panel>
        </row>

here i am setting the token app_name on init and using it just after in a panel, i can make that panel hidden always and set other values in the section of the panel. Since the init sets the token app_name only once, the processing based on that token in the second panel will remain constant.
I must confess I am unable to understand your functional requirements exactly though and looking at this from a purely technical angle wrt to the init settings

qbolbk59 · ‎08-26-2019

Hi @Sukisen1981 ,

I agree with your solution but unfortunately it's not getting me what i want. Please check the comment in the below response from @niketnilay . I have listed the requirement there.

KailA · ‎08-23-2019

Can you try modifying the init tag by change

<change>
     <condition match="$master_token$=='Data Entry'">
       <set token="data_entry">True</set>
       <unset token="attachment"></unset>
       <unset token="click_only"></unset>
     </condition>

     <condition match="$master_token$=='Click Only'">
       <set token="click_only">True</set>
       <unset token="data_entry"></unset>
       <unset token="attachment"></unset>

     </condition>

     <condition match="$master_token$=='Attachment'">
       <set token="attachment">True</set>
       <unset token="click_only"></unset>
       <unset token="data_entry"></unset>
     </condition>

 </change>

init will initialize the token for the first time and change will change the tokens value everytime you have a change on your master_token.

qbolbk59 · ‎08-23-2019

HI @KailA ,

The change tag would work if this token setting section is under the search tag. But i am setting these tokens in the tag, i mean outside all search tags. The reason being, as soon as the page loads, i want the tokens to be set as the tokens will then be used to load panels (using "depends").

niketn · ‎08-23-2019

@qbolbk59 this is the confusion, if you are trying setting tokens in the init section, where is the $master_token$ value coming from? Is it coming from another dashboard? If you do not design this properly, you will end up with a token that never resolves when the dashboard load.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

How to set token by comparing values of other token?

simple XML

Welcome to the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Adoption of RUM and APM at Splunk