Dashboards & Visualizations

token inside radio button value does not work

gongya
Engager

I have the following:

<form theme="dark">
<label>gongya-UWIT-NAT-DashBoard</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="var_OrigIP" searchWhenChanged="true">
<label>Original IP</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="text" token="var_dstIP" searchWhenChanged="true">
<label>Destination IP</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="radio" token="SPRT">
<label>$var_OrigIP$</label>
<choice value="index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport">Yes</choice>
<choice value="index=net_uwit_nat srcip=172.21.244.25">No</choice>
</input>

</fieldset>
<row>
<panel>

<table>
<search>
<query>$SPRT$
</query>
<earliest>-240m@m</earliest>
<latest>now</latest>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>

$var_OrigIP$ does not pick up the value.

Any ideas ?

thanks !!

Labels (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gongya 

Can you please try below sample code?

<form theme="dark" version="1.1">
	<label>gongya-UWIT-NAT-DashBoard</label>
	<fieldset submitButton="true" autoRun="false">
		<input type="text" token="var_OrigIP" searchWhenChanged="true">
			<label>Original IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="text" token="var_dstIP" searchWhenChanged="true">
			<label>Destination IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="radio" token="SPRT">
			<label>$var_OrigIP$</label>
			<choice value="Yes">Yes</choice>
			<choice value="No">No</choice>
			<change>
			  <condition value="Yes">
			    <set token="SPRTQuery">index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport</set>
			  </condition>
			  <condition>
			    <set token="SPRTQuery">index=net_uwit_nat srcip=172.21.244.25</set>
			  </condition>
			</change>
		</input>
	</fieldset>
	<row>
		<panel>
			<table>
				<title>$SPRTQuery$</title>
				<search>
					<query>$SPRTQuery$</query>
					<earliest>-240m@m</earliest>
					<latest>now</latest>
				</search>
				<option name="count">50</option>
				<option name="dataOverlayMode">none</option>
				<option name="drilldown">none</option>
				<option name="percentagesRow">false</option>
				<option name="refresh.display">progressbar</option>
				<option name="rowNumbers">false</option>
				<option name="totalsRow">false</option>
				<option name="wrap">true</option>
			</table>
		</panel>
	</row>
</form>

 

I think It should work for you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gongya 

Can you please try below sample code?

<form theme="dark" version="1.1">
	<label>gongya-UWIT-NAT-DashBoard</label>
	<fieldset submitButton="true" autoRun="false">
		<input type="text" token="var_OrigIP" searchWhenChanged="true">
			<label>Original IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="text" token="var_dstIP" searchWhenChanged="true">
			<label>Destination IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="radio" token="SPRT">
			<label>$var_OrigIP$</label>
			<choice value="Yes">Yes</choice>
			<choice value="No">No</choice>
			<change>
			  <condition value="Yes">
			    <set token="SPRTQuery">index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport</set>
			  </condition>
			  <condition>
			    <set token="SPRTQuery">index=net_uwit_nat srcip=172.21.244.25</set>
			  </condition>
			</change>
		</input>
	</fieldset>
	<row>
		<panel>
			<table>
				<title>$SPRTQuery$</title>
				<search>
					<query>$SPRTQuery$</query>
					<earliest>-240m@m</earliest>
					<latest>now</latest>
				</search>
				<option name="count">50</option>
				<option name="dataOverlayMode">none</option>
				<option name="drilldown">none</option>
				<option name="percentagesRow">false</option>
				<option name="refresh.display">progressbar</option>
				<option name="rowNumbers">false</option>
				<option name="totalsRow">false</option>
				<option name="wrap">true</option>
			</table>
		</panel>
	</row>
</form>

 

I think It should work for you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

gongya
Engager

thanks so so so much !! It works perfectly.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try setting a token in the change handler which uses the other token

0 Karma

gongya
Engager

Can you give an example ?

thanks !!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@gongya - You have it inside the static option of the radio button which is not evaluated. So it would not evaluate the value.

 

 

0 Karma

gongya
Engager

Do you mean I should use dynamic option ?

Tags (1)
0 Karma

gongya
Engager
0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...