set token with multiple values to different query

[nithys]

Hi 

The problem is token substitution in the dropdown input. Specifically:

1. Issue with entityToken Substitution:

   • The first value of the dropdown choice (e.g., target or CB) is not being correctly substituted into the $entityToken$ token.

<form version="1.1" theme="dark">
  <label>Stats  local Clone1</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="entityTokenFirst">
      <label>Select Data Entity</label>
      <!-- Set two values for each choice -->
      <choice value="target,*-test-targetf">Target </choice>
      <choice value="CB,*-test-cb">CB</choice>
      <default>target,*-test-targetf</default>
      <change>
        <!-- Split the value and set tokens for both parts -->
        <set token="entityLabel">$label$</set>
        <eval token="searchName">mvindex(split($value$, ","), 1)</eval>
        <eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
      </change>
    </input>

    <input type="time" token="timeToken">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

  <row>
    <panel>
      <single>
        <title>Distinct Consumer Count for $entityLabel$</title>
        <search>
          <query>
            index="" source="**" 
            | spath path=test.nsp3s{} output=nsp3s
            | mvexpand nsp3s
            | spath input=nsp3s path=Name output=Name
            | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
            | search Name=$searchName$
            | sort -_time
            | head 1
            | fields DistinctAdminUserCount
          </query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>

  <row>
    <panel>
      <title>Total Request :</title>
      <single>
        <search>
          <query>
            index="$indexToken$" source IN ("*-data-$stageToken$-$entityTokenFirst$") msg=":data:invoke" 
            | stats count
          </query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="height">317</option>
        <option name="rangeColors">["0xcba700","0xdc4e41"]</option>
        <option name="rangeValues">[200]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.size">large</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</form>​

This is causing the $entityToken$ token to not reflect the expected value in queries where it is used, such as:

source IN ("/aws/lambda/*-data-$stageToken$-$entityToken$"

• Correct Substitution for searchName:

  • The second value of the dropdown choice (e.g., -test-targetf or *-test-cb) is being correctly substituted into the $searchName$ token.
  • This indicates that the <eval> logic for searchName is working as expected:
    
    

    <eval token="searchName">mvindex(split($value$, ","), 1)</eval>

• Potential Cause of the Problem:

  • The <eval> logic for entityToken might not be working as expected:
    
    

    <eval token="entityToken">mvindex(split($value$, ","), 0)</eval?
  • This could be due to:
    • A syntax issue in the <eval> block.
    • A conflict with the token name entityToken elsewhere in the dashboard.
    • The $value$ token not being properly passed or split.

---

Problem:

• The first value of the dropdown choice (e.g., target or CBD) is not being correctly substituted into the $entityToken$ token in the Splunk dashboard.
• This is causing queries that rely on $entityToken$ to fail or use incorrect values.

Expected Behavior:

• $entityToken$ should be set to the first value of the selected dropdown choice (e.g., target or CB).
• $searchName$ should be set to the second value of the selected dropdown choice (e.g., *-test-targetf or *-test-cb).

Current Behavior:

• $searchName$ is correctly set to the second value of the dropdown choice.
• $entityToken$ is not being set to the first value of the dropdown choice.

Impact:

• Queries that rely on $entityToken$ are failing or using incorrect values, such as:

---

[ITWhisperer]

Your token name in the input is "entityTokenFirst" - you are then trying to reset this in the change handler - neither of these are "entityToken" (perhaps this is a typo?) - try using different names for the input token name and the token evaluated in the change handler.

[nithys]

@ITWhisperer 

i am using the correct $entityTokenFirst$  in the eval token and  query in the provided dashboard code  .looks like i typed mistakenly as $entityToken$
<change>
<!-- Split the value and set tokens for both parts -->
<set token="entityLabel">$label$</set>
<eval token="searchName">mvindex(split($value$, ","), 1)</eval>
<eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
</change>
<query>
index="$indexToken$" source IN ("*-data-$stageToken$-$entityTokenFirst$") msg=":data:invoke"
| stats count
</query>

<form version="1.1" theme="dark">
  <label>Stats  local Clone1</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="entityTokenFirst">
      <label>Select Data Entity</label>
      <!-- Set two values for each choice -->
      <choice value="target,*-test-targetf">Target </choice>
      <choice value="CB,*-test-cb">CB</choice>
      <default>target,*-test-targetf</default>
      <change>
        <!-- Split the value and set tokens for both parts -->
        <set token="entityLabel">$label$</set>
        <eval token="searchName">mvindex(split($value$, ","), 1)</eval>
        <eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
      </change>
    </input>

    <input type="time" token="timeToken">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

  <row>
    <panel>
      <single>
        <title>Distinct Consumer Count for $entityLabel$</title>
        <search>
          <query>
            index="" source="**" 
            | spath path=test.nsp3s{} output=nsp3s
            | mvexpand nsp3s
            | spath input=nsp3s path=Name output=Name
            | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
            | search Name=$searchName$
            | sort -_time
            | head 1
            | fields DistinctAdminUserCount
          </query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>

  <row>
    <panel>
      <title>Total Request :</title>
      <single>
        <search>
          <query>
            index="$indexToken$" source IN ("*-data-$stageToken$-$entityTokenFirst$") msg=":data:invoke" 
            | stats count
          </query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="height">317</option>
        <option name="rangeColors">["0xcba700","0xdc4e41"]</option>
        <option name="rangeValues">[200]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.size">large</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</form>

[ITWhisperer]

Try like this

  <fieldset submitButton="true">
    <input type="dropdown" token="entityToken">
      <label>Select Data Entity</label>
      <!-- Set two values for each choice -->
      <choice value="target,*-test-targetf">Target </choice>
      <choice value="CB,*-test-cb">CB</choice>
      <default>target,*-test-targetf</default>
      <change>
        <!-- Split the value and set tokens for both parts -->
        <set token="entityLabel">$label$</set>
        <eval token="searchName">mvindex(split($value$, ","), 1)</eval>
        <eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
      </change>
    </input>

    <input type="time" token="timeToken">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

[nithys]

@ITWhisperer still seeing same error with below dashboard code .

<form version="1.1" theme="dark">
  <label>Stats local Clone1</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="entityToken">
      <label>Select Data Entity</label>
      <!-- Set two values for each choice -->
      <choice value="target,*-test-targetf">Target </choice>
      <choice value="CB,*-test-cb">CB</choice>
      <default>target,*-test-targetf</default>
      <change>
        <!-- Split the value and set tokens for both parts -->
        <set token="entityLabel">$label$</set>
        <eval token="searchName">mvindex(split($value$, ","), 1)</eval>
        <eval token="entityTokenFirst">mvindex(split($value$, ","), 0)</eval>
      </change>
    </input>

    <input type="time" token="timeToken">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

  <row>
    <panel>
      <single>
        <title>Distinct Consumer Count for $entityLabel$</title>
        <search>
          <query>
            index="" source="**" 
            | spath path=test.nsp3s{} output=nsp3s
            | mvexpand nsp3s
            | spath input=nsp3s path=Name output=Name
            | spath input=nsp3s path=DistinctAdminUserCount output=DistinctAdminUserCount
            | search Name=$searchName$
            | sort -_time
            | head 1
            | fields DistinctAdminUserCount
          </query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>

  <row>
    <panel>
      <title>Total Request :</title>
      <single>
        <search>
          <query>
            index="$indexToken$" source IN ("/aws/lambda/-data-$stageToken$-$entityTokenFirst$") msg="gemini:streaming:info:*:init:data:invoke" 
            | stats count
          </query>
          <earliest>$timeToken.earliest$</earliest>
          <latest>$timeToken.latest$</latest>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="height">317</option>
        <option name="rangeColors">["0xcba700","0xdc4e41"]</option>
        <option name="rangeValues">[200]</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.size">large</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
</form>

[ITWhisperer · Accepted solution]

stageToken is not being set