I want to set one token value which includes another token's value "dc_no_tok".
But its not picking value of "dc_no_tok". I am not sue what I am doing wrong here?
I am passing "dc_no_tok" from another dashboard to this dashboard and I can see that token value is getting posted in url.
e.g:
https://abc/en-US/app/search/dc2_consul_level2_errors_test?form.host_tok=consul_server&form.dc_no_tok=2
XML:
=================
<input depends="$alwaysHide$" type="dropdown" token="host_tok" searchWhenChanged="true">
<label />
<change>
<condition value="consul_client">
<set token="Panel1">search host!=*consul* OR servername!=*consul* AND (host=pc$dc_no_tok$* OR servername=pc$dc_no_tok$* OR host=sc$dc_no_tok$* OR servername=sc$dc_no_tok$*) earliest=-5m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("Newer Consul version available") | eval ERROR=case(like(_raw, "%Push/Pull with%"), "Push/Pull Error", like(_raw, "%Failed fallback ping%"), "Failed fallback ping Error", like(_raw, "%connection reset by peer%"), "Connection reset by peer Error", like(_raw, "%keepalive timeout%"), "Keepalive Timeout Error", like(_raw, "%i/o timeout%"), "I/O Timeout Error", like(_raw, "%lead thread didn't get connection%"), "Lead thread didn't get connection Error", like(_raw, "%failed to get conn: EOF%"), "Failed to get conn: EOF Error", like(_raw, "%rpc error making call: EOF%"), "RPC error making call: EOF Error", like(_raw, "%Timeout exceeded while awaiting headers%"), "Timeout exceeded while awaiting headers Error", like(_raw, "%rpc error making call: Permission denied%"), "RPC error making call: Permission denied Error", like(_raw, "%Permission denied%"), "Permission denied Error", true(), "Other Error")| stats count by ERROR</set>
<set token="Panel2">host!=*consul* OR servername!=*consul* AND (host=pc$$dc_no_tok$$* OR servername=pc$dc_no_tok$* OR host=sc$dc_no_tok$* OR servername=sc$dc_no_tok$*) earliest=-60m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("Newer Consul version available")| chart count by host | trendline sma5(foo) AS sm_count</set>
</condition>
<condition value="consul_server">
<set token="Panel1">host=ss$dc_no_tok$consul* OR servername=ss$dc_no_tok$consul* earliest=-5m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("Newer Consul version available") | eval ERROR=case(like(_raw, "%Push/Pull with%"), "Push/Pull Error", like(_raw, "%Failed fallback ping%"), "Failed fallback ping Error", like(_raw, "%connection reset by peer%"), "Connection reset by peer Error", like(_raw, "%keepalive timeout%"), "Keepalive Timeout Error", like(_raw, "%i/o timeout%"), "I/O Timeout Error", like(_raw, "%lead thread didn't get connection%"), "Lead thread didn't get connection Error", like(_raw, "%failed to get conn: EOF%"), "Failed to get conn: EOF Error", like(_raw, "%rpc error making call: EOF%"), "RPC error making call: EOF Error", like(_raw, "%Timeout exceeded while awaiting headers%"), "Timeout exceeded while awaiting headers Error", like(_raw, "%rpc error making call: Permission denied%"), "RPC error making call: Permission denied Error", like(_raw, "%Permission denied%"), "Permission denied Error", true(), "Other Error")| stats count by ERROR</set>
<set token="Panel2">host=ss$dc_no_tok$consul* OR servername=ss$dc_no_tok$consul* earliest=-60m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("Newer Consul version available")| chart count by host | trendline sma5(foo) AS sm_count</set>
</condition>
</change>
<choice value="consul_client">Client</choice>
<choice value="consul_server">Server</choice>
<default />
</input>
=================
Your token usage in your example is inside a <change> block, so unless that data is being changed, then it will not trigger the change event to set the Panel* tokens. I have in the past done something similar by using a dashboard level or hidden panel search that does something like this
| makeresults
| eval tokVal=$dc_no_tok$, tokHost=$host_tok$
| table tokVal tokHost
and then the <done> clause of the search will do
<done>
<condition match="$result.tokHost$="consul_server">
<set token=...></set>
</condition>
<condition match="$result.tokHost$="consul_client">
<set token=...></set>
</condition>
</done>
I don't know if that's the 'right' solution - but as always with Splunk there are often several 'right' ways to achieve the same outcome.
@lping how is dc_no_tok token being set? Can you add that code?