Dashboards & Visualizations

token inside radio button value does not work

gongya
Engager

I have the following:

<form theme="dark">
<label>gongya-UWIT-NAT-DashBoard</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="var_OrigIP" searchWhenChanged="true">
<label>Original IP</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="text" token="var_dstIP" searchWhenChanged="true">
<label>Destination IP</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="radio" token="SPRT">
<label>$var_OrigIP$</label>
<choice value="index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport">Yes</choice>
<choice value="index=net_uwit_nat srcip=172.21.244.25">No</choice>
</input>

</fieldset>
<row>
<panel>

<table>
<search>
<query>$SPRT$
</query>
<earliest>-240m@m</earliest>
<latest>now</latest>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>

$var_OrigIP$ does not pick up the value.

Any ideas ?

thanks !!

Labels (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gongya 

Can you please try below sample code?

<form theme="dark" version="1.1">
	<label>gongya-UWIT-NAT-DashBoard</label>
	<fieldset submitButton="true" autoRun="false">
		<input type="text" token="var_OrigIP" searchWhenChanged="true">
			<label>Original IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="text" token="var_dstIP" searchWhenChanged="true">
			<label>Destination IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="radio" token="SPRT">
			<label>$var_OrigIP$</label>
			<choice value="Yes">Yes</choice>
			<choice value="No">No</choice>
			<change>
			  <condition value="Yes">
			    <set token="SPRTQuery">index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport</set>
			  </condition>
			  <condition>
			    <set token="SPRTQuery">index=net_uwit_nat srcip=172.21.244.25</set>
			  </condition>
			</change>
		</input>
	</fieldset>
	<row>
		<panel>
			<table>
				<title>$SPRTQuery$</title>
				<search>
					<query>$SPRTQuery$</query>
					<earliest>-240m@m</earliest>
					<latest>now</latest>
				</search>
				<option name="count">50</option>
				<option name="dataOverlayMode">none</option>
				<option name="drilldown">none</option>
				<option name="percentagesRow">false</option>
				<option name="refresh.display">progressbar</option>
				<option name="rowNumbers">false</option>
				<option name="totalsRow">false</option>
				<option name="wrap">true</option>
			</table>
		</panel>
	</row>
</form>

 

I think It should work for you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gongya 

Can you please try below sample code?

<form theme="dark" version="1.1">
	<label>gongya-UWIT-NAT-DashBoard</label>
	<fieldset submitButton="true" autoRun="false">
		<input type="text" token="var_OrigIP" searchWhenChanged="true">
			<label>Original IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="text" token="var_dstIP" searchWhenChanged="true">
			<label>Destination IP</label>
			<default>*</default>
			<initialValue>*</initialValue>
		</input>
		<input type="radio" token="SPRT">
			<label>$var_OrigIP$</label>
			<choice value="Yes">Yes</choice>
			<choice value="No">No</choice>
			<change>
			  <condition value="Yes">
			    <set token="SPRTQuery">index=net_uwit_nat srcip=$var_OrigIP$ | table srcip, transip, dstip, dstport | stats count(dstip) as Count by srcip, transip, dstip, dstport</set>
			  </condition>
			  <condition>
			    <set token="SPRTQuery">index=net_uwit_nat srcip=172.21.244.25</set>
			  </condition>
			</change>
		</input>
	</fieldset>
	<row>
		<panel>
			<table>
				<title>$SPRTQuery$</title>
				<search>
					<query>$SPRTQuery$</query>
					<earliest>-240m@m</earliest>
					<latest>now</latest>
				</search>
				<option name="count">50</option>
				<option name="dataOverlayMode">none</option>
				<option name="drilldown">none</option>
				<option name="percentagesRow">false</option>
				<option name="refresh.display">progressbar</option>
				<option name="rowNumbers">false</option>
				<option name="totalsRow">false</option>
				<option name="wrap">true</option>
			</table>
		</panel>
	</row>
</form>

 

I think It should work for you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

gongya
Engager

thanks so so so much !! It works perfectly.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try setting a token in the change handler which uses the other token

0 Karma

gongya
Engager

Can you give an example ?

thanks !!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@gongya - You have it inside the static option of the radio button which is not evaluated. So it would not evaluate the value.

 

 

0 Karma

gongya
Engager

Do you mean I should use dynamic option ?

Tags (1)
0 Karma

gongya
Engager
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...