Splunk Search

How to replace the value of a field by a token value in an xml form?

stephane_cyrill
Builder

Hi everyone,

I have a field call status, and I have a drop-down with values: open, new, in progress.......

What i need is:

1) When the user chooses a value from the drop-down, the status on the dashboard changes to that value

2) Is it possible to keep track of the changing of the status? How?

This is what I've tried:

<form>
  <label>CHANGE STATUS</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="status_token" searchWhenChanged="true">
      <label>Change status</label>
      <choice value="new">new</choice>
      <default>new</default>
      <choice value="Open">Open</choice>
      <choice value="Closed">Closed</choice>
      <choice value="progress">in progress</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title> </title>
      <table>
        <title>status is $status_token$</title>
        <search>
          <query>index=_* |eval status="change this status"|eval status=if($status_token$!="change this status",$status_token$ ,"change this status")| table host source status</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>
Tags (4)
1 Solution

Raghav2384
Motivator

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

stephane_cyrill
Builder

THanks Raghav2384

very much I try the quote on the token an it is working: status="$status_token$"

Raghav2384
Motivator

Please feel free to accept it as an answer 🙂

stephane_cyrill
Builder

I"m not seeing the link to accept but I voted.

0 Karma

Raghav2384
Motivator

there you go 🙂

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...