Dashboards & Visualizations

label usage in dashboard

pipipipi
Path Finder

Hi all,

I have dropdown input in my dashboard.

    <input type="dropdown" token="test" searchWhenChanged="false">
    <label>test</label>
    <choice value="hogehogehoge">ALL</choice>
    <choice value="hogehogehoge">ALL2</choice>
    <choice value="hogehogehoge">ALL3</choice>
    <default>ALL</default>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <change>
    <set token="label1">$label$</set>
</change>

I want use label value(like ALL, ALL2, ALL3) in my base search.
(this is example)

|makeresult 
[|eval test1="$label1$"]

but this eval command has no value.
How to get $label$ in eval command?

Thank you for helping me.

0 Karma

to4kawa
Ultra Champion
<form>
  <label>dropdown</label>
  <search id="base">
    <query>
         |makeresults 
   |eval command="sendmail"
      </query>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="hogehogehoge1">ALL</choice>
      <choice value="hogehogehoge2">ALL2</choice>
      <choice value="hogehogehoge3">ALL3</choice>
      <default>ALL</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <set token="label1">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base">
          <query>|eval to="hogehoge", subject="test", message="select is $label1$"</query>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

How about this?

0 Karma

vnravikumar
Champion

Hi

Can you please check the below code and let me know what issues are you facing.

<form>
  <label>dropdown</label>
  <search id="base">
    <query>
       |makeresults 
 |eval test1="$label1$"
    </query>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="hogehogehoge1">ALL</choice>
      <choice value="hogehogehoge2">ALL2</choice>
      <choice value="hogehogehoge3">ALL3</choice>
      <default>ALL</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <set token="label1">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base">

        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

pipipipi
Path Finder

Thank you for helping me.

  <form>
   <label>dropdown</label>
   <search id="base">
     <query>
        |makeresults 
  |eval test1="$label1$"
     </query>
   </search>
<search base="base"><query>
    |sendemail to="hogehoge" subject="test" message="select is $result.test1$"</query></search>
   <fieldset submitButton="true" autoRun="true">
     <input type="dropdown" token="test" searchWhenChanged="false>
       <label>test</label>
       <choice value="hogehogehoge1">ALL</choice>
       <choice value="hogehogehoge2">ALL2</choice>
       <choice value="hogehogehoge3">ALL3</choice>
       <default>ALL</default>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <change>
         <set token="label1">$label$</set>
       </change>
     </input>
   </fieldset>
 </form>

I want to put label value in my email message, but there is no value in my message.
if I put message="select is $label1$"
sendemail command execute twice.

0 Karma

vnravikumar
Champion

You can directly access the token label1, right without base search?

0 Karma

pipipipi
Path Finder

I think so.
if I put message="select is $label1$", email message is select is ALL.
(but I recieve 2 emails.....)

0 Karma

vnravikumar
Champion

can you make autoRun="false" and try it

0 Karma

pipipipi
Path Finder

It does not work.
When I remove $label$
Just 1 email. I have no idea,

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...