Getting Data In

How to auto-fill/refresh a filter?

andrehl
Explorer

Hi Community!

I would like the filter named [Total Distinct Customer in 2017 //ignore and Total Distinct Customer in 2018 //ignore] ,as attached in the picture, to fill itself with the number in the single value panel without having the user to click on it.
alt text

Thanks before!

0 Karma
1 Solution

renjith_nair
Legend

@andrehl ,

You could use a token (set once the search is done) to set the value.

E.g.

<form>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>sourcetype</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>|metadata type=sourcetypes|fields sourcetype</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="text" token="text">
      <label>Text</label>
      <!--Use the token which is set below as default vlaue of text box-->      
      <default>$mycount$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_* sourcetype=$sourcetype$|stats count</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <!--set the token value to the field name . Here its count-->
          <done>
            <set token="mycount">$result.count$</set>
          </done>
        </search>
        <option name="drilldown">none</option> 
      </single>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@andrehl ,

You could use a token (set once the search is done) to set the value.

E.g.

<form>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>sourcetype</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>|metadata type=sourcetypes|fields sourcetype</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="text" token="text">
      <label>Text</label>
      <!--Use the token which is set below as default vlaue of text box-->      
      <default>$mycount$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_* sourcetype=$sourcetype$|stats count</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <!--set the token value to the field name . Here its count-->
          <done>
            <set token="mycount">$result.count$</set>
          </done>
        </search>
        <option name="drilldown">none</option> 
      </single>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

andrehl
Explorer

my apology, I forgot to mention that my Time Range has to be an 'All Time'. Using your method, I can't seem to make it wait 'til the end of my search query.

0 Karma

renjith_nair
Legend

actually it does not matter because unless your search is completed, you don't have complete data and also the single value is also incomplete. So as soon as your result is complete, the value is being automatically shown in text box as well. You could use progress also instead of done but as mentioned its not the final result

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

andrehl
Explorer

It worked like a charm! Thank you so much!
May I know where can I get all the XML references from?

0 Karma

renjith_nair
Legend

Here you go - http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/tokens

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...