Dashboards & Visualizations

multidropdownview tokens: in javascript, they're arrays, how are they handled in splunk search?

cjpomer
Explorer

In the code below, I would like to join/combine the multiple-value $site$ such that it becomes a single value separated by a '|'. Then the regex (in the search manager) is an "or" on the values selected by the multidropdownview.

 <script>
    // Load the required libraries
    var deps = [
        "splunkjs/ready!",        
        "splunkjs/mvc/searchmanager",
        "splunkjs/mvc/multidropdownview",
    ];
   require(deps, function(mvc) {
        var SearchManager = require("splunkjs/mvc/searchmanager");
        var MultiDropDownView = require("splunkjs/mvc/multidropdownview");

        var tokens = mvc.Components.getInstance("default");

        var appsearch = new SearchManager ({
            id: "appsearch",
            search: mvc.tokenSafe("| inputlookup dropdown.csv  | regex site=\"$site$.*\" | fields application | dedup application | sort application"),
            preview: true,
            autostart: true
        });

        var sitesearch = new SearchManager ({/*stuff*/})

        var applications = new MultiDropDownView ({
            id: "sites",
            managerid: "sitesearch",
            value: mvc.tokenSafe("$site$"),
            valueField: "site",
            el: $("#sites")
        });
</script>
0 Karma
1 Solution

dfoster_splunk
Splunk Employee
Splunk Employee

Token substitution only works on string-valued tokens.

Therefore to substitute a string value based on an array-valued token, I'd suggest creating a second string token that you recompute when the array-valued token changes. For example:

    var tokens = mvc.Components.getInstance("default");

    // Transform $site$ -> $delimitedSites$ continuously
    tokens.on('change:site', function(tokens, site) {
        var delimitedSites = site.join('|');
        tokens.set('delimitedSites', delimitedSites);
    });

    var appsearch = new SearchManager ({
        search: mvc.tokenSafe("| inputlookup dropdown.csv  | regex site=\"$delimitedSites$.*\" | fields application | dedup application | sort application"),
        ...
    });

    var sitesearch = new SearchManager ({ ... })

    var applications = new MultiDropDownView ({
        value: mvc.tokenSafe("$site$"),
        ...
    });

There are some new framework features being developed that will make this pattern of creating derived tokens easier in the future.

View solution in original post

dfoster_splunk
Splunk Employee
Splunk Employee

Token substitution only works on string-valued tokens.

Therefore to substitute a string value based on an array-valued token, I'd suggest creating a second string token that you recompute when the array-valued token changes. For example:

    var tokens = mvc.Components.getInstance("default");

    // Transform $site$ -> $delimitedSites$ continuously
    tokens.on('change:site', function(tokens, site) {
        var delimitedSites = site.join('|');
        tokens.set('delimitedSites', delimitedSites);
    });

    var appsearch = new SearchManager ({
        search: mvc.tokenSafe("| inputlookup dropdown.csv  | regex site=\"$delimitedSites$.*\" | fields application | dedup application | sort application"),
        ...
    });

    var sitesearch = new SearchManager ({ ... })

    var applications = new MultiDropDownView ({
        value: mvc.tokenSafe("$site$"),
        ...
    });

There are some new framework features being developed that will make this pattern of creating derived tokens easier in the future.

cjpomer
Explorer

this works! w.r.t. features, i'd suggest allowing a function be passed to mvc.tokenSafe, which can perform javascript string functions on the token.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...