Solved: Re: Why is the token $result.field$ not populating...

wills2g · ‎05-23-2018

Hi All,

I have a problem where I'm trying to set the Default value of a multiselect input as the output of a particular search, and rather than populating the default value with the output of the search, it displays "$result.field$" instead.

The XML structure is:

<search>
  <query> search_text | table field </query>
  <done>
    <condition>
       <set token=field_token>$result.field$</set>
    </condition>
  </done>
</search>

<default>$field_token$</default>

So what I'm seeing in the multiselect input is "$field_token$" rather than the results from the search $result.field$.

Any ideas on what's going wrong?

niketn · ‎05-24-2018

@wills2g, have you verified that the token $field_token$ has value populated from search? You have used <condition> block. Have you validated that condition is met? If it does not meet the token will not be set.

Following is a run anywhere example that I tried and it sets the <default> option in multi-select

<form>
  <label>Multiselect Default Value using token</label>
  <search>
    <query>| makeresults
      | fields - field 
      | eval field="SomeDefaultValue"
      | table field
    </query>
    <done>
      <condition match="$job.resultCount$==0">
        <set token="field_token">SomeDefaultValue</set>
      </condition>
      <condition>
        <set token="field_token">$result.field$</set>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="multiselect" token="tokMultiSelect" searchWhenChanged="true">
      <label></label>
      <choice value="static">Static Option</choice>
      <delimiter> </delimiter>
      <default>$field_token$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          MultiSelect Value: $tokMultiSelect$, Populating Search Value: $field_token$
        </div>
      </html>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎05-24-2018

@wills2g, have you verified that the token $field_token$ has value populated from search? You have used <condition> block. Have you validated that condition is met? If it does not meet the token will not be set.

Following is a run anywhere example that I tried and it sets the <default> option in multi-select

<form>
  <label>Multiselect Default Value using token</label>
  <search>
    <query>| makeresults
      | fields - field 
      | eval field="SomeDefaultValue"
      | table field
    </query>
    <done>
      <condition match="$job.resultCount$==0">
        <set token="field_token">SomeDefaultValue</set>
      </condition>
      <condition>
        <set token="field_token">$result.field$</set>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="multiselect" token="tokMultiSelect" searchWhenChanged="true">
      <label></label>
      <choice value="static">Static Option</choice>
      <delimiter> </delimiter>
      <default>$field_token$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          MultiSelect Value: $tokMultiSelect$, Populating Search Value: $field_token$
        </div>
      </html>
    </panel>
  </row>
</form>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

wills2g · ‎05-24-2018

Thanks for your response. Following your example, I made some changes to clarify the issue I'm getting. I changed the field value to "Some Results" and the token value when no results are returned to be "No Results". When I run the dashboard, the default value first populates with "No Results" but when I hit F5 (refresh) on the dashboard, it populates correctly with "Some Results".

Also, on some other attempts, the default value populates as $result.field$ so neither "No Results" or "Some Results".

Any ideas on how to make this populate correctly when first opening the dashboard?

<form>
   <label>Multiselect Default Value using token</label>
   <search>
     <query>| makeresults
       | fields - field 
       | eval field="Some Results"
       | table field
     </query>
     <done>
       <condition match="$job.resultCount$==0">
         <set token="field_token">"No Results"</set>
       </condition>
       <condition>
         <set token="field_token">$result.field$</set>
       </condition>
     </done>
   </search>
   <fieldset submitButton="false">
     <input type="multiselect" token="tokMultiSelect" searchWhenChanged="true">
       <label></label>
       <choice value="static">Static Option</choice>
       <delimiter> </delimiter>
       <default>$field_token$</default>
     </input>
   </fieldset>
   <row>
     <panel>
       <html>
         <div>
           MultiSelect Value: $tokMultiSelect$, Populating Search Value: $field_token$
         </div>
       </html>
     </panel>
   </row>
 </form>

niketn · ‎05-25-2018

@wills2g, with <progress> search event handler you can have token value change as search progresses. With <done> token value is set only after search finishes.

However, depending on the search run duration token will show up as empty until it gets populated. So, $result.field$ will be shown instead of actual value until it is populated. Since this is the default value for multiselect, following could be couple of your options:

1) Create a <row><panel> with multiselect <input> and add the depends attribute to <row> with the token $tokMultiSelect$ . This will hide the row with multiselect input until the token is set.

2) Create a main Dashboard with a dummy <search> to populate the token $tokenMultiSelect$ and pass on to the current dashboard as Query string. This way the token with default value will be populated already when the Dashboard loads. (However, the link with query string in the main dashboard would need something similar to option 1. Otherwise there will be a possibility that someone will click the link before the token is populated.

Following is run anywhere example for Option 1

<form>
  <label>Multiselect Default Value using token</label>
  <search>
    <query>| makeresults
      | fields - field 
      | eval field="SomeDefaultValue"
      | table field
    </query>
    <done>
      <condition match="$job.resultCount$==0">
        <set token="field_token">No Results</set>
      </condition>
      <condition>
        <set token="field_token">$result.field$</set>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row depends="$tokMultiSelect$">
    <panel>
      <input type="multiselect" token="tokMultiSelect" searchWhenChanged="true">
        <label></label>
        <choice value="static">Static Option</choice>
        <delimiter> </delimiter>
        <default>$field_token$</default>
      </input>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        <div>
          MultiSelect Value: $tokMultiSelect$, Populating Search Value: $field_token$
        </div>
      </html>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

wills2g · ‎05-25-2018

Thank you very much, this solution worked!

Out of curiosity, Option 2 sounds very interesting so I was hoping you could elaborate a bit since this may be useful for some other functionality. Is this essentially linking two different dashboards? And how would you formulate a query string to reference a separate dashboard? Would this be better suited to a scheduled report as maybe another option?

niketn · ‎05-25-2018

If you have some dynamic options to be set for your dashboard before they load you would use option 2.

If you think about it, what happens with Splunk's default navigation is that you click a dashboard and the dashboard loads. Only static default options could be set trough the <default> option or through <init> section in the dashboard to set static tokens.

If you needed the option to be dynamic, you would have to set them else where and use
1) Splunk's <drilldown> <link> to your dashboard and pass on dynamic values using query string. URL query strings are standard things (you would notice them added to any dashboard with form inputs.). You can get Splunk Dashboard Examples App with examples of Drilldowns.

2) Using <html><panels> with anchor tags ( i.e. <a>) to link to destination dashboards. Following is one of my older answer for this approach. Query string is not present in the example but it is on the similar lines with how data can be passed on from one dashboard to another in Splunk Dashboard Examples app. https://answers.splunk.com/answers/595047/can-we-implement-cascading-dropdowns-in-a-dashboar.html

Hope this clarifies "stuff". Do up vote the comments if they helped and let us know if you need further help 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Why is the token $result.field$ not populating as default value in the multiSelect input?

Welcome to the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Adoption of RUM and APM at Splunk