Dashboards & Visualizations

label usage in dashboard

pipipipi
Path Finder

Hi all,

I have dropdown input in my dashboard.

    <input type="dropdown" token="test" searchWhenChanged="false">
    <label>test</label>
    <choice value="hogehogehoge">ALL</choice>
    <choice value="hogehogehoge">ALL2</choice>
    <choice value="hogehogehoge">ALL3</choice>
    <default>ALL</default>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <change>
    <set token="label1">$label$</set>
</change>

I want use label value(like ALL, ALL2, ALL3) in my base search.
(this is example)

|makeresult 
[|eval test1="$label1$"]

but this eval command has no value.
How to get $label$ in eval command?

Thank you for helping me.

0 Karma

to4kawa
Ultra Champion
<form>
  <label>dropdown</label>
  <search id="base">
    <query>
         |makeresults 
   |eval command="sendmail"
      </query>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="hogehogehoge1">ALL</choice>
      <choice value="hogehogehoge2">ALL2</choice>
      <choice value="hogehogehoge3">ALL3</choice>
      <default>ALL</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <set token="label1">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base">
          <query>|eval to="hogehoge", subject="test", message="select is $label1$"</query>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

How about this?

0 Karma

vnravikumar
Champion

Hi

Can you please check the below code and let me know what issues are you facing.

<form>
  <label>dropdown</label>
  <search id="base">
    <query>
       |makeresults 
 |eval test1="$label1$"
    </query>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="hogehogehoge1">ALL</choice>
      <choice value="hogehogehoge2">ALL2</choice>
      <choice value="hogehogehoge3">ALL3</choice>
      <default>ALL</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <set token="label1">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base">

        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

pipipipi
Path Finder

Thank you for helping me.

  <form>
   <label>dropdown</label>
   <search id="base">
     <query>
        |makeresults 
  |eval test1="$label1$"
     </query>
   </search>
<search base="base"><query>
    |sendemail to="hogehoge" subject="test" message="select is $result.test1$"</query></search>
   <fieldset submitButton="true" autoRun="true">
     <input type="dropdown" token="test" searchWhenChanged="false>
       <label>test</label>
       <choice value="hogehogehoge1">ALL</choice>
       <choice value="hogehogehoge2">ALL2</choice>
       <choice value="hogehogehoge3">ALL3</choice>
       <default>ALL</default>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <change>
         <set token="label1">$label$</set>
       </change>
     </input>
   </fieldset>
 </form>

I want to put label value in my email message, but there is no value in my message.
if I put message="select is $label1$"
sendemail command execute twice.

0 Karma

vnravikumar
Champion

You can directly access the token label1, right without base search?

0 Karma

pipipipi
Path Finder

I think so.
if I put message="select is $label1$", email message is select is ALL.
(but I recieve 2 emails.....)

0 Karma

vnravikumar
Champion

can you make autoRun="false" and try it

0 Karma

pipipipi
Path Finder

It does not work.
When I remove $label$
Just 1 email. I have no idea,

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...