Splunk Enterprise

How can I update the <valuePrefix> value in a multiselect or checkbox when the related token value is updated?

twidler
Explorer

Hello everyone. I have a Dropdown token being used as the <valuePrefix> in a Multiselect input. The Multiselect seems to only set the <valuePrefix> tag's value during dashboard initialization. I can get a change in the dropdown to take effect on the Multiselect when refreshing the page in the web browser, but not when changing the Dropdown value or when refreshing the panel. This same behaviour applies to the Checkbox input. 

Here is my code for the panel in question: 

    <panel depends="$Global_Tok$">
      <title>CPU</title>
      <input type="multiselect" token="CPU_Field_Global_Multi">
        <label>Fields</label>
        <choice value="(pctUser) AS User">User</choice>
        <choice value="(pctIdle) AS Idle">Idle</choice>
        <choice value="(Load) AS &quot;Load (-Idle)&quot;">Load</choice>
        <choice value="(pctIowait) AS IO_Wait">IO_Wait</choice>
        <choice value="(pctNice) AS Nice">Nice</choice>
        <choice value="(pctSystem) AS System">System</choice>
        <default>"(Load) AS ""Load (-Idle)""",(pctUser) AS User,(pctIdle) AS Idle,(pctIowait) AS IO_Wait,(pctNice) AS Nice,(pctSystem) AS System</default>
        <initialValue>(Load) AS "Load (-Idle)",(pctUser) AS User,(pctIdle) AS Idle,(pctIowait) AS IO_Wait,(pctNice) AS Nice,(pctSystem) AS System</initialValue>
        <valuePrefix>$Global_Function$</valuePrefix>
        <delimiter> </delimiter>
      </input>
      <input type="checkbox" token="CPU_Fields_Cbx">
        <label>Fields</label>
        <choice value="(pctUser) AS User">User</choice>
        <choice value="(pctIdle) AS Idle">Idle</choice>
        <choice value="(Load) AS &quot;Load (-Idle)&quot;">Load</choice>
        <choice value="(pctIowait) AS IO_Wait">IO_Wait</choice>
        <choice value="(pctNice) AS Nice">Nice</choice>
        <choice value="(pctSystem) AS System">System</choice>
        <valuePrefix>$Global_Function$</valuePrefix>
      </input>
      <chart>
        <search>
          <query>host=$HOST_SELECTION$ source=cpu
| multikv
| search CPU=$CPU_Core_Global_Tok$
| eval Load=(pctIdle-100)*-1
| timechart span=$Global_Span$ $CPU_Fields_Cbx$</query>
          <earliest>$Global_Time.earliest$</earliest>
          <latest>$Global_Time.latest$</latest>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleY.text">CPU Util (%)</option>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>

In this example code, the panel is only using the Checkbox input token for the search, but the same issue is applied when I use the Multiselect as well. The token I am updating with the Dropdown input is "$Global_Function$". 

The code for the Global Function dropdown input is as follows:

<input type="dropdown" token="Global_Function" depends="$Global_Tok$">
      <label>Function</label>
      <choice value="avg">Average</choice>
      <choice value="max">Maximum</choice>
      <default>avg</default>
      <initialValue>avg</initialValue>
    </input>

I have not been able to get the Multiselect or Checkbox inputs to change their initial <valuePrefix> value upon the Function Dropdown changing. So if anyone has suggestions on how to accomplish this, then I am all ears.

Labels (1)
0 Karma

twidler
Explorer

Unfortunately a week later, I have still not been able to find a solution to this issue. So if anyone has a suggestion on how to do this whether via Javascript or otherwise I am open to ideas.

0 Karma

twidler
Explorer

I still have not found a solution to this unfortunately and I don't have a whole lot of time to get this working. So if anyone has a suggestion, I am all for it.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...