Splunk Search

How to replace the value of a field by a token value in an xml form?

stephane_cyrill
Builder

Hi everyone,

I have a field call status, and I have a drop-down with values: open, new, in progress.......

What i need is:

1) When the user chooses a value from the drop-down, the status on the dashboard changes to that value

2) Is it possible to keep track of the changing of the status? How?

This is what I've tried:

<form>
  <label>CHANGE STATUS</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="status_token" searchWhenChanged="true">
      <label>Change status</label>
      <choice value="new">new</choice>
      <default>new</default>
      <choice value="Open">Open</choice>
      <choice value="Closed">Closed</choice>
      <choice value="progress">in progress</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title> </title>
      <table>
        <title>status is $status_token$</title>
        <search>
          <query>index=_* |eval status="change this status"|eval status=if($status_token$!="change this status",$status_token$ ,"change this status")| table host source status</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>
Tags (4)
1 Solution

Raghav2384
Motivator

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

stephane_cyrill
Builder

THanks Raghav2384

very much I try the quote on the token an it is working: status="$status_token$"

Raghav2384
Motivator

Please feel free to accept it as an answer 🙂

stephane_cyrill
Builder

I"m not seeing the link to accept but I voted.

0 Karma

Raghav2384
Motivator

there you go 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...