Getting Data In

Set token in the value of another token?

Communicator

Hello,

I'm looking for a possibility to use one token $token2$ as part of the value of another token.
For example you have a dropdown input that is $token1$ and you want to set $token2$ as part of the value of one choice like this:

 <input type="dropdown" token="token1" searchWhenChanged="false">
  <label> any </label>
  <choice> value="field = $token2$">Test</choice>
</input>

If I now use $token1$ in my search string I just get the string "$token2$" and not the value of $token2$. Is there a possibility to get the value of $token2$ in the value of $token1$ in simple xml without using macros??
Thanks for help
Greetings

Tags (3)
1 Solution

SplunkTrust
SplunkTrust

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

View solution in original post

SplunkTrust
SplunkTrust

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

View solution in original post

Path Finder

you are a freaking genius!

0 Karma

Path Finder

do you know how to re-run the search for token1 when the value for token2 changes?

0 Karma

Contributor

change value of searchWhenChanged to true. This will re-run search when value changes.