Solved: Populate dropdown based on initialized token

weidertc · ‎03-15-2019

I have a dashboard with a dropdown that contains a list of values. The value of the choices must change based on what is chosen from another dropdown, but the label needs to stay the same.

First, I tried just putting the token name in the value of the static dropdowns, but when I tried that, the dropdown defaulted to the value, instead of its label, which I think it does if no value matches what it has. In other words, Splunk is not parsing the value of the token in the static values. I can't have the value showing up in the label of the dropdown. This is unnacceptable for my use case.

Secondly, I removed all static choices and am using a dynamic query, but the query does not recognize the token either. I am using tokens in all of my other dynamic dropdowns just fine and i'm only having trouble with this one. It is the only one using a token initilized on page load. I verified the token is set on page load already by extracting its value elsewhere.

< form>
  <label>Title</label>
  <init>
    <set token="env_prod_tag">ProdIndexED</set>
    <set token="env_nonprod_tag">NonProdIndexED</set>
  </init>

The dropdown is this. It's basically 4 rows, or 4 makeresults appended together.

    <input type="dropdown" token="EnvironmentType" searchWhenChanged="false">
      <label>Environment Type</label>
      <default></default>
      <initialValue></initialValue>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>| makeresults 1 
| eval label="ED Production" 
| eval value=$env_prod_tag$
| append 
    [| makeresults 1 
    | eval label="All Production" 
    | eval value="ProdIndex"] 
| append 
    [| makeresults 1 
    | eval label="ED Non-Production" 
    | eval value=$env_nonprod_tag$] 
| append 
    [| makeresults 1 
    | eval label="All Non-Production" 
    | eval value="NonProdIndex"] 
| table label, value</query>
      </search>
    </input>

On the dashboard, both tags are confirmed set.

There is no error in the dropdown. I have a search panel with the same query as the dropdown so I can debug it. The error in the search panel is "Search is waiting for input...", indicating the token is not set.

The token is set.

Please let me know what I may be missing. thanks,
-Chris

niketn · ‎03-16-2019

@weidertc I think you are missing double quotes for tokens. Like | eval value="$env_prod_tag$"

Please try the following and confirm:

<form>
  <label>Dropdown</label>
   <init>
     <set token="env_prod_tag">ProdIndexED</set>
     <set token="env_nonprod_tag">NonProdIndexED</set>
   </init>
   <fieldset submitButton="false"></fieldset>
   <row>
     <panel>
       <input type="dropdown" token="EnvironmentType" searchWhenChanged="false">
         <label>Environment Type</label>
         <default></default>
         <initialValue></initialValue>
         <fieldForLabel>label</fieldForLabel>
         <fieldForValue>value</fieldForValue>
         <search>
           <query>| makeresults 1 
   | eval label="ED Production" 
   | eval value="$env_prod_tag$"
   | append 
       [| makeresults 1 
       | eval label="All Production" 
       | eval value="ProdIndex"] 
   | append 
       [| makeresults 1 
       | eval label="ED Non-Production" 
       | eval value="$env_nonprod_tag$"] 
   | append 
       [| makeresults 1 
       | eval label="All Non-Production" 
       | eval value="NonProdIndex"] 
   | table label, value</query>
         </search>
         <change>
           <set token="selectedLabel">$label$</set>
         </change>
       </input>
       <html>
         <div>
           Selected Label: $selectedLabel$ | Selected Value: $EnvironmentType$
         </div>
       </html>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <search>
           <query>| makeresults 1 
           | eval label="ED Production" 
           | eval value="$env_prod_tag$"
           | append 
               [| makeresults 1 
               | eval label="All Production" 
               | eval value="ProdIndex"] 
           | append 
               [| makeresults 1 
               | eval label="ED Non-Production" 
               | eval value="$env_nonprod_tag$"] 
           | append 
               [| makeresults 1 
               | eval label="All Non-Production" 
               | eval value="NonProdIndex"] 
           | table label, value
           </query>
         </search>
       </table>
     </panel>
   </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎03-16-2019

@weidertc I think you are missing double quotes for tokens. Like | eval value="$env_prod_tag$"

Please try the following and confirm:

<form>
  <label>Dropdown</label>
   <init>
     <set token="env_prod_tag">ProdIndexED</set>
     <set token="env_nonprod_tag">NonProdIndexED</set>
   </init>
   <fieldset submitButton="false"></fieldset>
   <row>
     <panel>
       <input type="dropdown" token="EnvironmentType" searchWhenChanged="false">
         <label>Environment Type</label>
         <default></default>
         <initialValue></initialValue>
         <fieldForLabel>label</fieldForLabel>
         <fieldForValue>value</fieldForValue>
         <search>
           <query>| makeresults 1 
   | eval label="ED Production" 
   | eval value="$env_prod_tag$"
   | append 
       [| makeresults 1 
       | eval label="All Production" 
       | eval value="ProdIndex"] 
   | append 
       [| makeresults 1 
       | eval label="ED Non-Production" 
       | eval value="$env_nonprod_tag$"] 
   | append 
       [| makeresults 1 
       | eval label="All Non-Production" 
       | eval value="NonProdIndex"] 
   | table label, value</query>
         </search>
         <change>
           <set token="selectedLabel">$label$</set>
         </change>
       </input>
       <html>
         <div>
           Selected Label: $selectedLabel$ | Selected Value: $EnvironmentType$
         </div>
       </html>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <search>
           <query>| makeresults 1 
           | eval label="ED Production" 
           | eval value="$env_prod_tag$"
           | append 
               [| makeresults 1 
               | eval label="All Production" 
               | eval value="ProdIndex"] 
           | append 
               [| makeresults 1 
               | eval label="ED Non-Production" 
               | eval value="$env_nonprod_tag$"] 
           | append 
               [| makeresults 1 
               | eval label="All Non-Production" 
               | eval value="NonProdIndex"] 
           | table label, value
           </query>
         </search>
       </table>
     </panel>
   </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

weidertc · ‎03-21-2019

i'll accept this as it's probably the right answer. I don't think I asked it correctly. I will start a new thread.

thanks for your help

weidertc · ‎03-18-2019

Good catch. I have just tried this, but it made no difference. I am still getting the value instead of the label.

weidertc · ‎03-18-2019

The value that shows is actually the default value. i confirmed this by setting it to something that the token can't be. the token value changes based on another selection, but regardless of how i change it, it just shows the default value for that input field.

Populate dropdown based on initialized token

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation