Splunk Enterprise

How to change token value?

pipipipi
Path Finder

Hi all,
I'm in trouble because the value of the fields tag doesn't change when the dropdown changes.

 

 <input type="dropdown" token="tk_report">
      <label>month</label>
      <fieldForLabel>reporting_month</fieldForLabel>
      <fieldForValue>reporting_month</fieldForValue>
      <search>
        <query>| makeresults 
| eval reporting_month=mvrange(relative_time(now(),"- 5mon@mon"),now(),"1mon") 
| table reporting_month 
| mvexpand reporting_month 
| eval reporting_month=strftime(reporting_month,"%Y-%m") 
| sort - reporting_month</query>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <change>
          <eval token="reporting_month1">strftime(relative_time(strptime($value$."-01","%Y-%m-%d"),"-1mon"),"%Y-%m")</eval>
          <eval token="reporting_month2">strftime(relative_time(strptime($value$."-01","%Y-%m-%d"),"-2mon"),"%Y-%m")</eval>
      </change>
      <selectFirstChoice>true</selectFirstChoice>
    </input>

 

This is table option

 

        <option name="count">10</option>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <fields["$reporting_month2$","$reporting_month1$","$tk_report$"]</fields>

 

 I think the first token remains.
but I have no idea to solve this problem.

Is there anyone know how to solve this problem?
Thank you for helping.

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...