Dashboards & Visualizations

Simple XML: Dynamic variables/value in choice tag

koshyk
Super Champion

hi,
I'm building a simple xml form so that user can select via dropdown. I've got a situation where the "Metric" logic is different. I'm currently trying to put the logic as choice value, but it doesn't not accept dynamic value (eg $Report_Type$). Hence during search, it comes up as $Report_Type$ instead of "ReportA". Any way to overcome this issue? (OR Any other method to set dynamic variable in simpleXML is also appreciated)

Example below

    <input type="radio" token="Report_Type" searchWhenChanged="true">
      <label>Select a Report:</label>
          <default>ReportA</default>

          <!-- Define the choices in code -->
          <choice value="ReportA">ReportA</choice>
          <choice value="ReportB">ReportB</choice>
    </input>

    <input type="dropdown" token="Metric" searchWhenChanged="true">
      <label>Select a Metric:</label>
          <default>Count</default>    
          <choice value="stats sum(count) by Time_Bucket,$Report_Type$| rename sum(count) as Customer_COUNT ">Count</choice>
          <choice value="eventstats max(count) as MAXVAL by $Report_Type$ | where (count=MAXVAL)| rename count as Customer_MAX_COUNT">Peak</choice>
    </input>        

    <row>
    <table>
    <searchPostProcess>$Metric$ ... Some other calculation</searchPostProcess>
      <option name="drilldown">off</option>
      <option name="showPager">true</option>
      <option name="count">20</option>
    </table>
  </row>
Tags (2)
0 Karma

somesoni2
Revered Legend

Try something like this (run anywhere xml code)

<form>
  <label>ReportType</label>
  <fieldset>
    <input type="radio" token="varIndex" searchWhenChanged="true">
      <label>Select an Index:</label>
      <default>_internal</default>
      <!-- Define the choices in code -->
      <choice value="_internal">_internal</choice>
      <choice value="main">main</choice>
    </input>
    <input type="dropdown" token="Metric" searchWhenChanged="true">
      <label>Select a Metric:</label>
      <default>Count</default>
      <populatingSearch fieldForLabel="key"  fieldForValue="value" >
        index="$varIndex$" | stats count as value | eval key="Count" | append [search index="$varIndex$" | stats count by date_mday | stats max(count) as value | eval key="Peak"]
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <title>Log events</title>
      <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>
  <row>
    <table>
      <title>Dropdown query</title>
      <searchString>index="$varIndex$" | stats count as value | eval key="Count" | append [search index="$varIndex$" | stats count by date_mday | stats max(count) as value | eval key="Peak"]</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>
</form>
0 Karma

DavidHourani
Super Champion

Why not combine both choices into the same dropdown list and have 4 choices instead of 2 like:

1- Count For ReportA

2- Peak For Report A

3- Count For Report B

4- Peak For Report B

You can also try troubleshooting to check if "report_Type" is actually taking the default value...try putin $Report_Type$ in a title or something just to make sure that you can read the choice you made...if you can't read the choice it's probably a problem with the radio button...try replacing it with a drowndown list if you want 🙂

0 Karma

tugnet
Explorer

did you find any solution? got the same problem 😕

0 Karma

koshyk
Super Champion

unfortunately, not. I had to switch to advanced XML (sidieviewutil) for this.

Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...