Dashboards & Visualizations

How to use multiple tokens with multiple searches in a form?

_gkollias
Builder

Hi,

I am redesigning a dashboard where I'd like the text inputs token to preload in order to use downstream within another token.

Here is a simpler version of the Simple XML:

    <form>
    <fieldset submitButton="true">
        <input type="text" token="name1">
            <label>Name1:</label>
            <default></default>
        </input>
        <input type="text" token="name2">
            <label>Name2:</label>
            <default></default>
        </input>
        <input type="text" token="name3">
            <label>Name3:</label>
            <default></default>
        </input>
        <input type="text" token="name4">
            <label>Name4:</label>
            <default></default>
        </input>

        <input type="dropdown" token="search_results" searchWhenChanged="false">
            <label>Type:</label>
            <default>*</default>
            <choice value="*">All</choice>
            <choice value="`search1A` $name1$ $name2$ $name3$ $name4$ | `search1B`">Type</choice>
            <choice value="`search2A` $name1$ $name2$ $name3$ $name4$ | `search2B`">Type</choice>
            <choice value="`search3A` $name1$ $name2$ $name3$ $name4$ | `search3B`">Type</choice>
            <choice value="`search4A` $name1$ $name2$ $name3$ $name4$ | `search4B`">Type</choice>
        </input>
    </fieldset>

    <row>
        <panel>
            <table id="search_results">
                <title>Your Search Results:</title>
                <searchString>
                    <![CDATA[ $search_results$ ]]>
                </searchString>
            </table>
        </panel>
    </row>
</form>

There may be a more optimal way of creating this functionality. Any insight would be greatly appreciated.

Thanks!

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Text input tokens can be passed via the query string as part of the URL that launches the page.

In the URL string the first parameter starts with ? then the others use &: https://someurl:8000?form.name1=abc&form.name2=xyz

This will set those values when the page loads for the user.

0 Karma

_gkollias
Builder

Thanks for your answer, sjohnson. Instead of doing any sort of drilldown here, I was hoping that if we could add some value in to the text input and click submit, that value would get passed downstream to the query that runs all in the same view. I may end up re-engineering this one :-).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...