I am on Splunk 8.1 trying to create a dynamic dashboard. I am trying to create a multisearch query, the searches for which will be based on the checkboxes that the user clicks.
<input type="time" token="field1">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="userinput1">
<label>User Input 1</label>
</input>
<input type="text" token="userinput2">
<label>User Input 2</label>
</input>
<input type="checkbox" token="indexesSelected" searchWhenChanged="true">
<label>Indexes</label>
<choice value="[search index=index1 $userinput1$ $userinput2$]">Index 1</choice>
<choice value="[search index=index2 $userinput1$ $userinput2$]">Index 2</choice>
<default></default>
<initialValue></initialValue>
<delimiter> </delimiter>
<prefix>| multisearch [eval test1="test1"] [eval test2="test2"] </prefix>
</input>
The search part looks like this:
<search>
<query>$indexesSelected$
| table _time, index, field1, field2, field3, field4
| sort Time
</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
This works as expected except that the final query looks like this:
| multisearch [eval test1="test1"] [eval test2="test2"] [search index=index1 $userinput1$ $userinput2$] [search index=index2 $userinput1$ $userinput2$]
How can I make these $userinput1$ and $userinput2$ be converted to their token value from the user inputs in the dashboard and not as literal strings.
I have tried to use <change> tags to use eval and set based on the <condition> that the user selects, but eval does not allow token value and replaces with literal strings only. Something like this:
<change>
<condition match="like($indexesSelected$,"%index1%")">
<eval token="finalQuery">replace($indexesSelected$,"index1", "[search index=index1 $userinput1$ $userinput2$]")</eval>
</condition>
<condition match="like($indexesSelected$,"%index2%")">
<eval token="finalQuery">replace($indexesSelected$,"index2", "[search index=index2 $userinput1$ $userinput2$]")</eval>
</condition>
</change>