Splunk Dev

How to replace query input variables with variable values

ayushipaul
Engager

</input>
<input type="dropdown" token="project">
<label>Project</label>
<choice value="tok1*">Token1</choice>
<choice value="tok2*">Token2</choice>
<default>tok1</default>
<initialValue>tok1</initialValue>
<change>
<condition value="tok1">
<set token="x-key">key1-</set>
</condition>
<condition value="tok2">
<set token="x-key">key2-</set>
</condition>
</change>
</input>

<input type="multiselect" token="minorstate">
<label>minorstate</label>
<choice value="*">All</choice>
<choice value="&quot;a&quot;, &quot;b&quot;, &quot;c&quot;, &quot;d&quot;,">Minorstate</choice>
<default>"""a"", ""b"", ""c"", ""d""</default>
<prefix>(</prefix>
<suffix>)</suffix>
<initialValue>a,"b","c","d"</initialValue>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> , </delimiter>
<fieldForLabel>minorstate</fieldForLabel>
<fieldForValue>minorstate</fieldForValue>
<search>
<query>index=dunamis* sourcetype=dunamis_* producer=dunamis project=$project$ "x-key=$x-key$" | stats count by minorstate</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>

The variables $project$ and $x-key$ are not getting replaced by the values that are being set in the dropdown. Can someone please help? Thank you!

0 Karma

renjith_nair
Legend

Can you try changing the condition value to tok1* instead of tok1 ?

 

Here is a run anywhere example for reference

<form version="1.1" theme="light">
  <label>Tokens</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="project" searchWhenChanged="true">
      <label>Project</label>
      <choice value="tok1*">Token1</choice>
      <choice value="tok2*">Token2</choice>
      <change>
        <condition value="tok1*">
          <set token="x-key">Key1</set>
        </condition>
        <condition value="tok2*">
          <set token="x-key">Key2</set>
        </condition>
      </change>
    </input>
    <input type="multiselect" token="Record">
      <label>Record</label>
      <delimiter> ,</delimiter>
      <fieldForLabel>Record</fieldForLabel>
      <fieldForValue>Record</fieldForValue>
      <search>
        <query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|search project=$project$ AND x-key=$x-key$</query>
      </search>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Project = $project$  , Key = $x-key$, Record = $Record$</title>
      <table>
        <title>Results</title>
        <search>
          <query>|makeresults count=5|streamstats count|eval Record="Record".count|eval count=ceil(count/2)|eval project="tok".count."abc",x-key="Key".count|fields - _time,count|where Record in ($Record$)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...