Hello,
I'm looking for a possibility to use one token $token2$ as part of the value of another token.
For example you have a dropdown input that is $token1$ and you want to set $token2$ as part of the value of one choice like this:
<input type="dropdown" token="token1" searchWhenChanged="false">
<label> any </label>
<choice> value="field = $token2$">Test</choice>
</input>
If I now use $token1$ in my search string I just get the string "$token2$" and not the value of $token2$. Is there a possibility to get the value of $token2$ in the value of $token1$ in simple xml without using macros??
Thanks for help
Greetings
Try this sample (splunk 6 simple xml)
<form>
<label>OneTokenAsValueForAnotherToken</label>
<fieldset>
<input type="dropdown" token="token2" searchWhenChanged="false">
<label> any </label>
<choice value="splunkd">splunkd</choice>
</input>
<input type="dropdown" token="token1" searchWhenChanged="false">
<populatingSearch fieldForValue="Test" fieldForLabel="Test">
<![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
</populatingSearch>
</input>
</fieldset>
<row>
<table>
<searchString>index=_internal $token1$| stats count by sourcetype</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
</table>
</row>
</form>
Try this sample (splunk 6 simple xml)
<form>
<label>OneTokenAsValueForAnotherToken</label>
<fieldset>
<input type="dropdown" token="token2" searchWhenChanged="false">
<label> any </label>
<choice value="splunkd">splunkd</choice>
</input>
<input type="dropdown" token="token1" searchWhenChanged="false">
<populatingSearch fieldForValue="Test" fieldForLabel="Test">
<![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
</populatingSearch>
</input>
</fieldset>
<row>
<table>
<searchString>index=_internal $token1$| stats count by sourcetype</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
</table>
</row>
</form>
you are a freaking genius!
do you know how to re-run the search for token1 when the value for token2 changes?
change value of searchWhenChanged to true. This will re-run search when value changes.