Splunk Enterprise

How can I update the <valuePrefix> value in a multiselect or checkbox when the related token value is updated?

twidler
Explorer

Hello everyone. I have a Dropdown token being used as the <valuePrefix> in a Multiselect input. The Multiselect seems to only set the <valuePrefix> tag's value during dashboard initialization. I can get a change in the dropdown to take effect on the Multiselect when refreshing the page in the web browser, but not when changing the Dropdown value or when refreshing the panel. This same behaviour applies to the Checkbox input. 

Here is my code for the panel in question: 

    <panel depends="$Global_Tok$">
      <title>CPU</title>
      <input type="multiselect" token="CPU_Field_Global_Multi">
        <label>Fields</label>
        <choice value="(pctUser) AS User">User</choice>
        <choice value="(pctIdle) AS Idle">Idle</choice>
        <choice value="(Load) AS &quot;Load (-Idle)&quot;">Load</choice>
        <choice value="(pctIowait) AS IO_Wait">IO_Wait</choice>
        <choice value="(pctNice) AS Nice">Nice</choice>
        <choice value="(pctSystem) AS System">System</choice>
        <default>"(Load) AS ""Load (-Idle)""",(pctUser) AS User,(pctIdle) AS Idle,(pctIowait) AS IO_Wait,(pctNice) AS Nice,(pctSystem) AS System</default>
        <initialValue>(Load) AS "Load (-Idle)",(pctUser) AS User,(pctIdle) AS Idle,(pctIowait) AS IO_Wait,(pctNice) AS Nice,(pctSystem) AS System</initialValue>
        <valuePrefix>$Global_Function$</valuePrefix>
        <delimiter> </delimiter>
      </input>
      <input type="checkbox" token="CPU_Fields_Cbx">
        <label>Fields</label>
        <choice value="(pctUser) AS User">User</choice>
        <choice value="(pctIdle) AS Idle">Idle</choice>
        <choice value="(Load) AS &quot;Load (-Idle)&quot;">Load</choice>
        <choice value="(pctIowait) AS IO_Wait">IO_Wait</choice>
        <choice value="(pctNice) AS Nice">Nice</choice>
        <choice value="(pctSystem) AS System">System</choice>
        <valuePrefix>$Global_Function$</valuePrefix>
      </input>
      <chart>
        <search>
          <query>host=$HOST_SELECTION$ source=cpu
| multikv
| search CPU=$CPU_Core_Global_Tok$
| eval Load=(pctIdle-100)*-1
| timechart span=$Global_Span$ $CPU_Fields_Cbx$</query>
          <earliest>$Global_Time.earliest$</earliest>
          <latest>$Global_Time.latest$</latest>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleY.text">CPU Util (%)</option>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>

In this example code, the panel is only using the Checkbox input token for the search, but the same issue is applied when I use the Multiselect as well. The token I am updating with the Dropdown input is "$Global_Function$". 

The code for the Global Function dropdown input is as follows:

<input type="dropdown" token="Global_Function" depends="$Global_Tok$">
      <label>Function</label>
      <choice value="avg">Average</choice>
      <choice value="max">Maximum</choice>
      <default>avg</default>
      <initialValue>avg</initialValue>
    </input>

I have not been able to get the Multiselect or Checkbox inputs to change their initial <valuePrefix> value upon the Function Dropdown changing. So if anyone has suggestions on how to accomplish this, then I am all ears.

Labels (1)
0 Karma

twidler
Explorer

Unfortunately a week later, I have still not been able to find a solution to this issue. So if anyone has a suggestion on how to do this whether via Javascript or otherwise I am open to ideas.

0 Karma

twidler
Explorer

I still have not found a solution to this unfortunately and I don't have a whole lot of time to get this working. So if anyone has a suggestion, I am all for it.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...