Pass Token To Dashboard Table of Results

[IRHM73]

Hi,

I wonder whether someone could help me please.

I've put together the following form:

<form>
      <label>Digital Verify &amp; Match</label>
      <description></description>
      <fieldset submitButton="false">
        <input type="time" token="DashboardTime" searchWhenChanged="false">
          <label>Please Select the Time Range</label>
          <default>
            <earliest>@d</earliest>
            <latest>now</latest>
          </default>
        </input>
        <input type="dropdown" token="username" searchWhenChanged="false">
          <label>Please Select the Customer Name</label>
          <search>
            <query>index=main auditSource="matching" auditType="Tx*" detail.input-ida-request="*" earliest=$DashboardTime.earliest$ latest=$DashboardTime.latest$         
     | rex field="detail.input-ida-request" "\"firstName\":{\"value\":\"(?<idaFName>[^\"]+)"   
     | rex field="detail.input-ida-request" "\"surnames\":\[\{\"value\":\"(?<idaSName>[^\"]+)"  
     | eval idaFullName= idaFName." ".idaSName  | stats dc(idaFullName) first(inOrOut) As inOrOut By idaFullName  
     | stats count by idaFullName</query>
          </search>
          <fieldForLabel>idaFullName</fieldForLabel>
          <fieldForValue>idaFullName</fieldForValue>
        </input>
      </fieldset>
      <row>
        <panel>
          <table>
            <title>Data Table</title>
            <search>
              <query>auditSource="matching" auditType="Tx*" detail.input-ida-request="*"
     | rex field="detail.input-ida-request" "\"firstName\":{\"value\":\"(?<idaFName>[^\"]+)" 
     | rex field="detail.input-ida-request" "\"surnames\":\[\{\"value\":\"(?<idaSName>[^\"]+)"
     | eval idaFullName= idaFName." ".idaSName
     | idaFullName=$username$
     | table idaFullName idaFullDetails cidFullDetails ErrorCode generatedAt | rename idaFullName TO "Customer Name"</query>
            </search>
            <option name="wrap">true</option>
            <option name="rowNumbers">false</option>
            <option name="drilldown">cell</option>
            <option name="dataOverlayMode">none</option>
            <option name="count">10</option>
          </table>
        </panel>
      </row>
    </form>

The problem I'm having is passing the value from the drop-down menu (token=username) to the table of results despite adding idaFullName=$username$

I just wonder whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

[maciep]

Well, what you have there isn't a valid a command. Are you trying to filter your results at that point? If so, then you probably want to use where.

| where idaFullName=$username$

If you're not trying to filter, what are you trying to do?

[IRHM73]

Hi @maciep, firstly my sincere apologies for not coming back to you sooner but I just wanted to say thank you for your solution which worked great.

Many thanks and kind regards

Chris

[jeffland · Accepted solution]

Your search is

auditSource="matching" auditType="Tx*" detail.input-ida-request="*"
  | rex field="detail.input-ida-request" "\"firstName\":{\"value\":\"(?<idaFName>[^\"]+)" 
  | rex field="detail.input-ida-request" "\"surnames\":\[\{\"value\":\"(?<idaSName>[^\"]+)"
  | eval idaFullName= idaFName." ".idaSName
  | idaFullName=$username$
  | table idaFullName idaFullDetails cidFullDetails ErrorCode generatedAt | rename idaFullName TO "Customer Name"

?
Then you're probably missing a where as a command in the sixth row.
Also, you should consider adding quotes around the content of your token, either within it as a setting of the token:

<prefix>"</prefix>
<suffix>"</suffix>

or in your search (such as ... | where idaFullName="$username$" | ... to avoid trouble with field values containing whitespaces and the like.
You can always output the content of a token by using it within the title of a panel. That sometimes helps to see if the token itself is correct (thus the problem has to be after that, while using it somewhere) or whether the token doesn't contain what you want it to.

[IRHM73]

hi @jeffland, firstly my apologies for coming back to you so late with this, but I just wanted to let you know your solution worked great.

Many thanks and kind regards

Chris

[ariswadkar]

you can also use $token|s$ to have it capture the whitespace too.