Dashboards & Visualizations

token inside radio button value does not work

gongya
Engager

I have the following:

<form theme="dark">
<label>gongya-UWIT-NAT-DashBoard</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="var_OrigIP" searchWhenChanged="true">
<label>Original IP</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="text" token="var_dstIP" searchWhenChanged="true">
<label>Destination IP</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="radio" token="SPRT">
<label>$var_OrigIP$</label>
<choice value="index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport">Yes</choice>
<choice value="index=net_uwit_nat srcip=172.21.244.25">No</choice>
</input>

</fieldset>
<row>
<panel>

<table>
<search>
<query>$SPRT$
</query>
<earliest>-240m@m</earliest>
<latest>now</latest>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>

$var_OrigIP$ does not pick up the value.

Any ideas ?

thanks !!

Labels (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gongya 

Can you please try below sample code?

<form theme="dark" version="1.1">
	<label>gongya-UWIT-NAT-DashBoard</label>
	<fieldset submitButton="true" autoRun="false">
		<input type="text" token="var_OrigIP" searchWhenChanged="true">
			<label>Original IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="text" token="var_dstIP" searchWhenChanged="true">
			<label>Destination IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="radio" token="SPRT">
			<label>$var_OrigIP$</label>
			<choice value="Yes">Yes</choice>
			<choice value="No">No</choice>
			<change>
			  <condition value="Yes">
			    <set token="SPRTQuery">index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport</set>
			  </condition>
			  <condition>
			    <set token="SPRTQuery">index=net_uwit_nat srcip=172.21.244.25</set>
			  </condition>
			</change>
		</input>
	</fieldset>
	<row>
		<panel>
			<table>
				<title>$SPRTQuery$</title>
				<search>
					<query>$SPRTQuery$</query>
					<earliest>-240m@m</earliest>
					<latest>now</latest>
				</search>
				<option name="count">50</option>
				<option name="dataOverlayMode">none</option>
				<option name="drilldown">none</option>
				<option name="percentagesRow">false</option>
				<option name="refresh.display">progressbar</option>
				<option name="rowNumbers">false</option>
				<option name="totalsRow">false</option>
				<option name="wrap">true</option>
			</table>
		</panel>
	</row>
</form>

 

I think It should work for you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gongya 

Can you please try below sample code?

<form theme="dark" version="1.1">
	<label>gongya-UWIT-NAT-DashBoard</label>
	<fieldset submitButton="true" autoRun="false">
		<input type="text" token="var_OrigIP" searchWhenChanged="true">
			<label>Original IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="text" token="var_dstIP" searchWhenChanged="true">
			<label>Destination IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="radio" token="SPRT">
			<label>$var_OrigIP$</label>
			<choice value="Yes">Yes</choice>
			<choice value="No">No</choice>
			<change>
			  <condition value="Yes">
			    <set token="SPRTQuery">index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport</set>
			  </condition>
			  <condition>
			    <set token="SPRTQuery">index=net_uwit_nat srcip=172.21.244.25</set>
			  </condition>
			</change>
		</input>
	</fieldset>
	<row>
		<panel>
			<table>
				<title>$SPRTQuery$</title>
				<search>
					<query>$SPRTQuery$</query>
					<earliest>-240m@m</earliest>
					<latest>now</latest>
				</search>
				<option name="count">50</option>
				<option name="dataOverlayMode">none</option>
				<option name="drilldown">none</option>
				<option name="percentagesRow">false</option>
				<option name="refresh.display">progressbar</option>
				<option name="rowNumbers">false</option>
				<option name="totalsRow">false</option>
				<option name="wrap">true</option>
			</table>
		</panel>
	</row>
</form>

 

I think It should work for you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

gongya
Engager

thanks so so so much !! It works perfectly.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try setting a token in the change handler which uses the other token

0 Karma

gongya
Engager

Can you give an example ?

thanks !!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@gongya - You have it inside the static option of the radio button which is not evaluated. So it would not evaluate the value.

 

 

0 Karma

gongya
Engager

Do you mean I should use dynamic option ?

Tags (1)
0 Karma

gongya
Engager
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...