Dashboards & Visualizations

Set a form variable based on a separate form variable

bruceclarke
Contributor

I am building a dashboard where a user supplies a single request GUID using a text input. We use the request GUID to determine (among other things) which endpoint on our platform was hit for that request.

I want to set a form variable to have the value of the endpoint that was hit. So, I want to run a search for the GUID, return the endpoint, and store that for later use. Ideally the XML would look something like this:

<fieldset submitButton="true">
  <input type="text" token="formRequestGuid" searchWhenChanged="true">
    <label>Request GUID:</label>
    <change>
      <set token="formEndPoint">[search index=requestdata requestGuid="$formRequestGuid$" | head 1 | return $endPoint]</set>
    </change>
  </input>
</fieldset>
...
<row>
  <panel>
    <title>Load Time for $formEndPoint$</title>
    ...
  </panel>
</row>

Obviously this doesn't work for a few reasons, but hopefully the theoretical XML gets across what I want to do. Right now I see a few issues with this XML:

  1. Text inputs don't let you set a token on "change" conditions
  2. You cannot set a token to the value returned from a search
  3. You cannot set a dashboard title to the return value of a search (this would be a possible workaround)

Does anyone know of a good way to workaround these issues?

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi bruceclarke, you might be able to get close by using a populating search filling a dropdown with available guids : see populatingSearch at http://docs.splunk.com/Documentation/Splunk/6.0.4/Viz/PanelreferenceforSimplifiedXML#Form_inputs

Let me know how this works out.

0 Karma

bruceclarke
Contributor

Unfortunately each GUID corresponds to a specific request in our product. So there can be millions of GUIDs that we would need to search. Given this constraint, we feel we need to use a text input for the GUID.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...