Dashboards & Visualizations

How to use user input token in Checkbox value in Splunk Dashboard?

New Member

I am on Splunk 8.1 trying to create a dynamic dashboard. I am trying to create a multisearch query, the searches for which will be based on the checkboxes that the user clicks.


<input type="time" token="field1">
<input type="text" token="userinput1">
    <label>User Input 1</label>
<input type="text" token="userinput2">
    <label>User Input 2</label>
<input type="checkbox" token="indexesSelected" searchWhenChanged="true">
    <choice value="[search index=index1 $userinput1$ $userinput2$]">Index 1</choice>
    <choice value="[search index=index2 $userinput1$ $userinput2$]">Index 2</choice>
    <delimiter> </delimiter>
    <prefix>| multisearch [eval test1="test1"] [eval test2="test2"] </prefix>


The search part looks like this:


        | table _time, index, field1, field2, field3, field4 
        | sort Time



This works as expected except that the final query looks like this:

| multisearch [eval test1="test1"] [eval test2="test2"]
[search index=index1 $userinput1$ $userinput2$]
[search index=index2 $userinput1$ $userinput2$]

How can I make these $userinput1$ and $userinput2$ be converted to their token value from the user inputs in the dashboard and not as literal strings.

I have tried to use <change> tags to use eval and set based on the <condition> that the user selects, but eval does not allow token value and replaces with literal strings only. Something like this:


    <condition match="like($indexesSelected$,&quot;%index1%&quot;)">
        <eval token="finalQuery">replace($indexesSelected$,"index1", "[search index=index1 $userinput1$ $userinput2$]")</eval>
    <condition match="like($indexesSelected$,&quot;%index2%&quot;)">
        <eval token="finalQuery">replace($indexesSelected$,"index2", "[search index=index2 $userinput1$ $userinput2$]")</eval>


Labels (1)
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...