splunk xml dashboard

[pjac1029]

I created a  dashboard with an input  that allows the user to select a user field from a dropdown that's populated by a lookup table.  

I want to prefix the selected user with "production\"
and run a query In a panel that retrieves firewall events  where the user = the new token value (prefixed with "production\") since the user in the firewall index is prefixed with "production".

The first time I select the user from the lookup the query retrieves  events.

the next time I select another user the set token does not prefix the token with "production".
instead it searches with the user selected value and returns no events.

the done block apparently only executes the first time through
below is xml.

Thanks in advance.

<label>firewall blocks</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="username" searchWhenChanged="true">
<label>username</label>
<fieldForLabel>username</fieldForLabel>
<fieldForValue>username</fieldForValue>
<search>
<query>| inputlookup test_users.csv | table username</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<set token="username">prod\\$username$</set>
</done>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>

index=firewall sourcetype=firewall user = "$username$" | table $username$ user action </query>

<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>

[livehybrid]

Hi @pjac1029 

Simply add "<prefix>production</prefix>" within your <input></input> block like this:

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat · Accepted solution]

@pjac1029 

I reviewed the XML and implemented the solution using a token prefix strategy combined with test data via makeresults (since I currently don't have real firewall data).

I replaced the <done> block with a <change> block in the dropdown input to ensure that the prefix logic (e.g., "prod\") applies every time the user changes the selection. This resolved the issue where the token was only set once. I also validated the dropdown behavior and confirmed that event filtering works as expected based on the selected username.

<dashboard version="1.1">
<label>Firewall Blocks Dashboard (Test Data)</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="raw_username" searchWhenChanged="true">
<label>Select Username</label>
<fieldForLabel>username</fieldForLabel>
<fieldForValue>username</fieldForValue>
<search>
<query>| inputlookup test_users.csv | table username</query>
</search>
<change>
<set token="username">prod\\$value$</set>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
| makeresults 
| eval user="prod\\john.doe", action="blocked"
| append [| makeresults | eval user="prod\\jane.smith", action="allowed"]
| append [| makeresults | eval user="prod\\bob.jones", action="blocked"]
| search user="$username$"
| table user action
</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</dashboard>

[pjac1029]

that worked ! Thanks so much for your help. I really appreciate it !

[kiran_panchavat]

@pjac1029 

You're most welcome! I'm glad to hear that it worked for you. 😊