How to pass token from search result?

[smanojkumar]

Hi All,

     I had a panel "OS", that gives the value os in single value visualization, 

based on the value of os, 

if it were "*windows*" it should display a panel "defender version", not "Agent version" panel,

If it were "MAC" or "OS X" or "IOS" it should display "Agent version" panel, not "defender version" panel,

I don't need drop down by selecting the values in "OS" panel, The os values wants to make impact on choosing the panel.

<form theme="dark">
  <label> ASSET STATUS</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="radio" token="category" searchWhenChanged="true">
      <label>Category</label>
      <choice value="work">Work</choice>
      <choice value="auto">Auto</choice>
      <choice value="server">Server</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>work</default>
      <change>
        <condition value="work">
          <set token="Work">"Work"</set>
          <unset token="Auto"></unset>
        </condition>
        <condition value="auto">
          <set token="Auto">"Auto"</set>
          <unset token="Work"></unset>
        </condition>
        <condition value="server">
          <set token="Server">"Server"</set>
          <unset token="Work"></unset>
          <unset token="Auto"></unset>
        </condition>
      </change>
    </input>
    <input type="text" token="src_name" searchWhenChanged="true">
      <label>src_name</label>
      <default>*</default>
    </input>
  </fieldset>
<row>
              <panel>
      <title>OS</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, os
| search src_name IN ($src_name$)
| table os</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
</row>
<row>
    <panel depends="$Work$">
      <title>Defender Sig Version</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, defender_sig_version_check
| search src_name IN ($src_name$)
| table defender_sig_version_check</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <title>Agent Version</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields agentVersion_value,base_agentVersion_value, src_name
| search src_name IN ($src_name$)
| eval edr_mac_check=if(agentVersion_value&gt;=base_agentVersion_value,3,0)
| table edr_mac_check</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>

Thanks in Advance!

[ITWhisperer · Accepted solution]

Try something like this

<form theme="dark">
  <label> ASSET STATUS</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="radio" token="category" searchWhenChanged="true">
      <label>Category</label>
      <choice value="work">Work</choice>
      <choice value="auto">Auto</choice>
      <choice value="server">Server</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>work</default>
      <change>
        <condition value="work">
          <set token="Work">"Work"</set>
          <unset token="Auto"></unset>
        </condition>
        <condition value="auto">
          <set token="Auto">"Auto"</set>
          <unset token="Work"></unset>
        </condition>
        <condition value="server">
          <set token="Server">"Server"</set>
          <unset token="Work"></unset>
          <unset token="Auto"></unset>
        </condition>
      </change>
    </input>
    <input type="text" token="src_name" searchWhenChanged="true">
      <label>src_name</label>
      <default>*</default>
    </input>
  </fieldset>
<row>
              <panel>
      <title>OS</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, os
| search src_name IN ($src_name$)
| table os</query>
          <done>
            <eval token="showDefender">if(match($result.os$,"Windows"),1,null())</eval>
            <eval token="showAgent">if(match($result.os$,"Windows"),null(),1)</eval>
          </done>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
</row>
<row>
    <panel depends="$showDefender$">
      <title>Defender Sig Version</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, defender_sig_version_check
| search src_name IN ($src_name$)
| table defender_sig_version_check</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel depends="$showAgent$">
      <title>Agent Version</title>
      <single>
        <search>
          <query>| inputlookup $category$_sanity_check_kvstore
| fields agentVersion_value,base_agentVersion_value, src_name
| search src_name IN ($src_name$)
| eval edr_mac_check=if(agentVersion_value&gt;=base_agentVersion_value,3,0)
| table edr_mac_check</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xdc4e41","0x53a051"]</option>
        <option name="rangeValues">[0]</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>