Dashboards & Visualizations

Why are the tokens from Drop down menu used in base search are not working?

macadminrohit
Contributor

Hi ,

I have created a base search like this :

index=servers sourcetype=json Version=17 Id=$ID$ 

As can be seen from here $ID$ is the token for the field value of Id field. Below in the dashboard XML I have defined the logic to populate the value of this token. But ultimately in the search queries it shows Id=$result.TS$ where TS is the value of the token being set against the item selected in the drop down. When I remove this base search and use it just like a normal search, it works fine. I am trying to use the base search concept to load up the dashboard faster because in most of the queries the search terms are common which I have defined in the base search.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If the ID is a dropdown token, it shouldn't have $result. prefix. Try using the exact token name for the dropdown input in your query.

0 Karma

macadminrohit
Contributor

My bad $SPACE$ is the drop down token.

index=servers sourcetype=json Version=17 Id=$SPACE$

0 Karma

macadminrohit
Contributor

So if you see, if someone selects the option TECH space, we want hidden dropdown to be invoked

0 Karma

kmaron
Motivator

could you share the XML you have for populating the token and your full base search?

0 Karma

macadminrohit
Contributor

This is the base search :

<query>index=servers sourcetype=json Version=17 Id=$ID$


XML for populating the token value



<input type="dropdown" token="Space" searchWhenChanged="true">
      <label>Select a Space Number:</label>
      <default>tech</default>
      <choice value="*">All space</choice>
      <choice value="tech">TECH space</choice>
      <fieldForLabel>spaceName</fieldForLabel>
      <fieldForValue>SPACE</fieldForValue>
      <search>
        <query>| inputlookup servers.csv | search OPEN="Y"  
        | sort SPACE 
        | rex mode=sed field=SPACE "s/(\d+)/000\1/" 
        | rex mode=sed field=SPACE "s/0*([0-9]{4})/\1/" 
        | eval spaceName = SPACE+"-"+SPACE_NAME+"-"+SPACE 
        | table SPACE spaceName</query>
      </search>
      <change>
        <condition value="tech">
          <set token="TC_SPACE_FLAG">Y</set>
        </condition>
        <condition>
          <unset token="TC_SPACE_FLAG"></unset>
        </condition>
      </change>
      <suffix>*</suffix>
    </input>
    <input type="dropdown" token="TECH_SPACE" searchWhenChanged="true" depends="$HideIt$">
      <label>TECH_SPACE</label>
      <fieldForLabel>TS</fieldForLabel>
      <fieldForValue>TS</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| inputlookup server.csv | search TC_SPACE=$TC_SPACE_FLAG$ | table SPACE
        | rex mode=sed field=SPACE "s/(\d+)/000\1/" 
        | rex mode=sed field=SPACE "s/0*([0-9]{4})/\1/" 
        | eval TS="ID="+SPACE
        | table TS
        | mvcombine delim=" OR " TS | nomv TS
        | rex mode=sed field=TS "s/^ID\=//"</query>
        <done>
          <set token="SPACE">$result.TS$</set>
        </done>
0 Karma

kmaron
Motivator

I don't see anywhere in that code where you actually set the token named $ID$

0 Karma

macadminrohit
Contributor

Yes my bad, That should be $SPACE$ which i am using in the base query.

0 Karma

macadminrohit
Contributor

Now since is see the Token values being populated, but i see a weird behaviour. Since the base search is at the top and being executed first with ID=$SPACE$ value, and the corresponding populating search takes time to populate all the values because of which ID=$results.TS$ and the sub query doesnt find any results and displays 0 results. Whereas when i open the inline search i can the results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...