Getting Data In

Set token in the value of another token?

C_Sparn
Communicator

Hello,

I'm looking for a possibility to use one token $token2$ as part of the value of another token.
For example you have a dropdown input that is $token1$ and you want to set $token2$ as part of the value of one choice like this:

 <input type="dropdown" token="token1" searchWhenChanged="false">
  <label> any </label>
  <choice> value="field = $token2$">Test</choice>
</input>

If I now use $token1$ in my search string I just get the string "$token2$" and not the value of $token2$. Is there a possibility to get the value of $token2$ in the value of $token1$ in simple xml without using macros??
Thanks for help
Greetings

Tags (3)
1 Solution

somesoni2
Revered Legend

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

View solution in original post

somesoni2
Revered Legend

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

bnorthway
Path Finder

you are a freaking genius!

0 Karma

bnorthway
Path Finder

do you know how to re-run the search for token1 when the value for token2 changes?

0 Karma

kamal_jagga
Contributor

change value of searchWhenChanged to true. This will re-run search when value changes.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...