Use token value to set another token by using repl...

cedriclac · ‎08-29-2019

Hello,

I try to using the token set up in a checkbox who will create a token like that:
(" F " OR " E " OR " W ")
this token will be used as filter on _raw data
but i want to use the token information to refine the search after a rex where i create a column call errorlvl so i want to convert the value of token by using a serie of replace to something like this :
(errorlvl="F" OR errorlvl="E" OR errorlvl="W")

I already know the replace the sequence to use but I have a issue to create in simple xml. Could you help me ?
Thanks

renjith_nair · ‎08-29-2019

@cedriclac ,

You dont need to replace token. You can directly set it at the input level

  <fieldset submitButton="false">
    <input type="checkbox" token="tokErrorLevel" searchWhenChanged="true">
      <label>Error Level</label>
      <choice value="F">F</choice>
      <choice value="E">E</choice>
      <choice value="W">W</choice>
      <valuePrefix>errorlvl="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <default>F</default>
    </input>
  </fieldset>

Now you could use the token $tokErrorLevel$ in your search which will add values based on the input selection

Dummy dashboard to try

<form>
  <label>CheckBox</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tokErrorLevel" searchWhenChanged="true">
      <label>Error Level</label>
      <choice value="F">F</choice>
      <choice value="E">E</choice>
      <choice value="W">W</choice>
      <valuePrefix>errorlvl="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <default>F</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
    <h1>
      $tokErrorLevel$
    </h1>
  </html>
    </panel>
  </row>
</form>

---
What goes around comes around. If it helps, hit it with Karma 🙂

Use token value to set another token by using replace

Building Reliable Asset and Identity Frameworks in Splunk ES

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

Automatic Discovery Part 3: Practical Use Cases

Are you a member of the Splunk Community?

Use token value to set another token by using replace

Building Reliable Asset and Identity Frameworks in Splunk ES

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

Automatic Discovery Part 3: Practical Use Cases