Solved: Populate dropdown based on initialized token

weidertc · ‎03-15-2019

I have a dashboard with a dropdown that contains a list of values. The value of the choices must change based on what is chosen from another dropdown, but the label needs to stay the same.

First, I tried just putting the token name in the value of the static dropdowns, but when I tried that, the dropdown defaulted to the value, instead of its label, which I think it does if no value matches what it has. In other words, Splunk is not parsing the value of the token in the static values. I can't have the value showing up in the label of the dropdown. This is unnacceptable for my use case.

Secondly, I removed all static choices and am using a dynamic query, but the query does not recognize the token either. I am using tokens in all of my other dynamic dropdowns just fine and i'm only having trouble with this one. It is the only one using a token initilized on page load. I verified the token is set on page load already by extracting its value elsewhere.

< form>
  <label>Title</label>
  <init>
    <set token="env_prod_tag">ProdIndexED</set>
    <set token="env_nonprod_tag">NonProdIndexED</set>
  </init>

The dropdown is this. It's basically 4 rows, or 4 makeresults appended together.

    <input type="dropdown" token="EnvironmentType" searchWhenChanged="false">
      <label>Environment Type</label>
      <default></default>
      <initialValue></initialValue>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>| makeresults 1 
| eval label="ED Production" 
| eval value=$env_prod_tag$
| append 
    [| makeresults 1 
    | eval label="All Production" 
    | eval value="ProdIndex"] 
| append 
    [| makeresults 1 
    | eval label="ED Non-Production" 
    | eval value=$env_nonprod_tag$] 
| append 
    [| makeresults 1 
    | eval label="All Non-Production" 
    | eval value="NonProdIndex"] 
| table label, value</query>
      </search>
    </input>

On the dashboard, both tags are confirmed set.

There is no error in the dropdown. I have a search panel with the same query as the dropdown so I can debug it. The error in the search panel is "Search is waiting for input...", indicating the token is not set.

The token is set.

Please let me know what I may be missing. thanks,
-Chris

niketn · ‎03-16-2019

@weidertc I think you are missing double quotes for tokens. Like | eval value="$env_prod_tag$"

Please try the following and confirm:

<form>
  <label>Dropdown</label>
   <init>
     <set token="env_prod_tag">ProdIndexED</set>
     <set token="env_nonprod_tag">NonProdIndexED</set>
   </init>
   <fieldset submitButton="false"></fieldset>
   <row>
     <panel>
       <input type="dropdown" token="EnvironmentType" searchWhenChanged="false">
         <label>Environment Type</label>
         <default></default>
         <initialValue></initialValue>
         <fieldForLabel>label</fieldForLabel>
         <fieldForValue>value</fieldForValue>
         <search>
           <query>| makeresults 1 
   | eval label="ED Production" 
   | eval value="$env_prod_tag$"
   | append 
       [| makeresults 1 
       | eval label="All Production" 
       | eval value="ProdIndex"] 
   | append 
       [| makeresults 1 
       | eval label="ED Non-Production" 
       | eval value="$env_nonprod_tag$"] 
   | append 
       [| makeresults 1 
       | eval label="All Non-Production" 
       | eval value="NonProdIndex"] 
   | table label, value</query>
         </search>
         <change>
           <set token="selectedLabel">$label$</set>
         </change>
       </input>
       <html>
         <div>
           Selected Label: $selectedLabel$ | Selected Value: $EnvironmentType$
         </div>
       </html>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <search>
           <query>| makeresults 1 
           | eval label="ED Production" 
           | eval value="$env_prod_tag$"
           | append 
               [| makeresults 1 
               | eval label="All Production" 
               | eval value="ProdIndex"] 
           | append 
               [| makeresults 1 
               | eval label="ED Non-Production" 
               | eval value="$env_nonprod_tag$"] 
           | append 
               [| makeresults 1 
               | eval label="All Non-Production" 
               | eval value="NonProdIndex"] 
           | table label, value
           </query>
         </search>
       </table>
     </panel>
   </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎03-16-2019

@weidertc I think you are missing double quotes for tokens. Like | eval value="$env_prod_tag$"

Please try the following and confirm:

<form>
  <label>Dropdown</label>
   <init>
     <set token="env_prod_tag">ProdIndexED</set>
     <set token="env_nonprod_tag">NonProdIndexED</set>
   </init>
   <fieldset submitButton="false"></fieldset>
   <row>
     <panel>
       <input type="dropdown" token="EnvironmentType" searchWhenChanged="false">
         <label>Environment Type</label>
         <default></default>
         <initialValue></initialValue>
         <fieldForLabel>label</fieldForLabel>
         <fieldForValue>value</fieldForValue>
         <search>
           <query>| makeresults 1 
   | eval label="ED Production" 
   | eval value="$env_prod_tag$"
   | append 
       [| makeresults 1 
       | eval label="All Production" 
       | eval value="ProdIndex"] 
   | append 
       [| makeresults 1 
       | eval label="ED Non-Production" 
       | eval value="$env_nonprod_tag$"] 
   | append 
       [| makeresults 1 
       | eval label="All Non-Production" 
       | eval value="NonProdIndex"] 
   | table label, value</query>
         </search>
         <change>
           <set token="selectedLabel">$label$</set>
         </change>
       </input>
       <html>
         <div>
           Selected Label: $selectedLabel$ | Selected Value: $EnvironmentType$
         </div>
       </html>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <search>
           <query>| makeresults 1 
           | eval label="ED Production" 
           | eval value="$env_prod_tag$"
           | append 
               [| makeresults 1 
               | eval label="All Production" 
               | eval value="ProdIndex"] 
           | append 
               [| makeresults 1 
               | eval label="ED Non-Production" 
               | eval value="$env_nonprod_tag$"] 
           | append 
               [| makeresults 1 
               | eval label="All Non-Production" 
               | eval value="NonProdIndex"] 
           | table label, value
           </query>
         </search>
       </table>
     </panel>
   </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

weidertc · ‎03-21-2019

i'll accept this as it's probably the right answer. I don't think I asked it correctly. I will start a new thread.

thanks for your help

weidertc · ‎03-18-2019

Good catch. I have just tried this, but it made no difference. I am still getting the value instead of the label.

weidertc · ‎03-18-2019

The value that shows is actually the default value. i confirmed this by setting it to something that the token can't be. the token value changes based on another selection, but regardless of how i change it, it just shows the default value for that input field.

Populate dropdown based on initialized token

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

Preparing your Splunk Environment for OpenSSL3

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector