Token Not Binding with Dropdown on Dashboard

[bmkaiser]

I'm trying to build a dashboard element that will take input from a dropdown field and perform a search based on the item selected from the dashboard. No matter what I try, the search doesn't seem to take to the dropdown selection. I'm not writing this in XML, I'm just trying to use the dashboard wizard to build the panel. Nonetheless, here's what the XML looks like:

<fieldset submitButton="false">
    <input type="dropdown" token="appName" searchWhenChanged="true">
      <label>App Name</label>
      <search>
        <query>| DBQUERY ... | SEARCH DisplayName = $appName$ ...</query>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>Label</fieldForLabel>
      <fieldForValue>Value</fieldForValue>
      <choice value="App Name">App Name</choice>
      <default>App Name</default>
    </input>
  </fieldset>

I've also tried wrapping my token in quotes like below based on another Splunk question that I came across, but it didn't seem to make a difference:

<query>| DBQUERY ... | SEARCH DisplayName = "$appName$" ...</query

Thank you in advance for your help.

[MuS · Accepted solution]

Hi bmkaiser,

you're using the token of the drop down in its populating search; this will not work.
The token $appName$ can only be used in panel searches in your dashboard like this:

index=db_foo thisDBapp=$appName$ | ...

For the drop down replace the query line with this:

<query>| DBQUERY ... | SEARCH DisplayName = * ...</query>

and it should work.

Hope this helps ...

cheers, MuS

[bmkaiser]

Thank you, but I'm not quite sure I understand. The DBQUERY is really what does the searching for the panel search. So what I think you're saying is that I should remove the SEARCH command from my panel search and replace it with what you have above. Is this right?

The dropdown query would look like this:
| Search DisplayName=$appName$

But I'm not sure how to change the panel query

[somesoni2]

The sample xml you provided is for a dropdown, not the panel (defined inside 'fieldset'). And what @MuS is saying that you can't use the token in the same search which defines it. You should have a panel search, outside fieldset and you'd be able to use this token in panel search.

[bmkaiser]

Is this right, then?

<fieldset submitButton="false">
    <input type="dropdown" token="appName" searchWhenChanged="true">
      <label>Select App from List</label>
      <choice value="App Name">App Name</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>App Panel</title>
        <search>
          <query>| DBQUERY ... | SEARCH "App Name" = "$appName$" ...</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>

[somesoni2]

Syntax wise this is right. Do you intend to have a hard-coded application name in the dropdown? Will it have just one value?

See how the splunk dashboard with form input looks like here
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/PanelreferenceforSimplifiedXML

[bmkaiser]

Thank you for the resource! I'll look through to see what I can learn.

I plan to have multiple values. They may be hard coded, but it would be ideal if the list were populated with all of the app names based on a different query.