Set a form variable based on a separate form variable

[bruceclarke]

I am building a dashboard where a user supplies a single request GUID using a text input. We use the request GUID to determine (among other things) which endpoint on our platform was hit for that request.

I want to set a form variable to have the value of the endpoint that was hit. So, I want to run a search for the GUID, return the endpoint, and store that for later use. Ideally the XML would look something like this:

<fieldset submitButton="true">
  <input type="text" token="formRequestGuid" searchWhenChanged="true">
    <label>Request GUID:</label>
    <change>
      <set token="formEndPoint">[search index=requestdata requestGuid="$formRequestGuid$" | head 1 | return $endPoint]</set>
    </change>
  </input>
</fieldset>
...
<row>
  <panel>
    <title>Load Time for $formEndPoint$</title>
    ...
  </panel>
</row>

Obviously this doesn't work for a few reasons, but hopefully the theoretical XML gets across what I want to do. Right now I see a few issues with this XML:

1. Text inputs don't let you set a token on "change" conditions
2. You cannot set a token to the value returned from a search
3. You cannot set a dashboard title to the return value of a search (this would be a possible workaround)

Does anyone know of a good way to workaround these issues?

[muebel]

Hi bruceclarke, you might be able to get close by using a populating search filling a dropdown with available guids : see populatingSearch at http://docs.splunk.com/Documentation/Splunk/6.0.4/Viz/PanelreferenceforSimplifiedXML#Form_inputs

Let me know how this works out.

[bruceclarke]

Unfortunately each GUID corresponds to a specific request in our product. So there can be millions of GUIDs that we would need to search. Given this constraint, we feel we need to use a text input for the GUID.