Dashboards & Visualizations

How to use user input token in Checkbox value in Splunk Dashboard?

surajp
New Member

I am on Splunk 8.1 trying to create a dynamic dashboard. I am trying to create a multisearch query, the searches for which will be based on the checkboxes that the user clicks.

 

<input type="time" token="field1">
    <label>Time</label>
    <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
    </default>
</input>
<input type="text" token="userinput1">
    <label>User Input 1</label>
</input>
<input type="text" token="userinput2">
    <label>User Input 2</label>
</input>
<input type="checkbox" token="indexesSelected" searchWhenChanged="true">
    <label>Indexes</label>
    <choice value="[search index=index1 $userinput1$ $userinput2$]">Index 1</choice>
    <choice value="[search index=index2 $userinput1$ $userinput2$]">Index 2</choice>
    <default></default>
    <initialValue></initialValue>
    <delimiter> </delimiter>
    <prefix>| multisearch [eval test1="test1"] [eval test2="test2"] </prefix>
</input>

 

The search part looks like this:

 

<search>
    <query>$indexesSelected$ 
        | table _time, index, field1, field2, field3, field4 
        | sort Time
    </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
</search>

 

 

This works as expected except that the final query looks like this:

| multisearch [eval test1="test1"] [eval test2="test2"]
[search index=index1 $userinput1$ $userinput2$]
[search index=index2 $userinput1$ $userinput2$]

How can I make these $userinput1$ and $userinput2$ be converted to their token value from the user inputs in the dashboard and not as literal strings.

I have tried to use <change> tags to use eval and set based on the <condition> that the user selects, but eval does not allow token value and replaces with literal strings only. Something like this:

 

<change>
    <condition match="like($indexesSelected$,&quot;%index1%&quot;)">
        <eval token="finalQuery">replace($indexesSelected$,"index1", "[search index=index1 $userinput1$ $userinput2$]")</eval>
    </condition>
    <condition match="like($indexesSelected$,&quot;%index2%&quot;)">
        <eval token="finalQuery">replace($indexesSelected$,"index2", "[search index=index2 $userinput1$ $userinput2$]")</eval>
    </condition>
</change>

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...