Getting Data In

Set token in the value of another token?

C_Sparn
Communicator

Hello,

I'm looking for a possibility to use one token $token2$ as part of the value of another token.
For example you have a dropdown input that is $token1$ and you want to set $token2$ as part of the value of one choice like this:

 <input type="dropdown" token="token1" searchWhenChanged="false">
  <label> any </label>
  <choice> value="field = $token2$">Test</choice>
</input>

If I now use $token1$ in my search string I just get the string "$token2$" and not the value of $token2$. Is there a possibility to get the value of $token2$ in the value of $token1$ in simple xml without using macros??
Thanks for help
Greetings

Tags (3)
1 Solution

somesoni2
Revered Legend

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

View solution in original post

somesoni2
Revered Legend

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

bnorthway
Path Finder

you are a freaking genius!

0 Karma

bnorthway
Path Finder

do you know how to re-run the search for token1 when the value for token2 changes?

0 Karma

kamal_jagga
Contributor

change value of searchWhenChanged to true. This will re-run search when value changes.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...