Splunk Search

How to replace the value of a field by a token value in an xml form?

stephane_cyrill
Builder

Hi everyone,

I have a field call status, and I have a drop-down with values: open, new, in progress.......

What i need is:

1) When the user chooses a value from the drop-down, the status on the dashboard changes to that value

2) Is it possible to keep track of the changing of the status? How?

This is what I've tried:

<form>
  <label>CHANGE STATUS</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="status_token" searchWhenChanged="true">
      <label>Change status</label>
      <choice value="new">new</choice>
      <default>new</default>
      <choice value="Open">Open</choice>
      <choice value="Closed">Closed</choice>
      <choice value="progress">in progress</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title> </title>
      <table>
        <title>status is $status_token$</title>
        <search>
          <query>index=_* |eval status="change this status"|eval status=if($status_token$!="change this status",$status_token$ ,"change this status")| table host source status</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>
Tags (4)
1 Solution

Raghav2384
Motivator

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

stephane_cyrill
Builder

THanks Raghav2384

very much I try the quote on the token an it is working: status="$status_token$"

Raghav2384
Motivator

Please feel free to accept it as an answer 🙂

stephane_cyrill
Builder

I"m not seeing the link to accept but I voted.

0 Karma

Raghav2384
Motivator

there you go 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...