Splunk Search

How to use token value in stats group by field in Splunk dashboard

kasimanikandan
Engager

Hi Team,

I have stats group by fields as token it will change dynamically based on time selection. for example if select since 1st Jun 24 then my query will be like below.

eventtype="abc" |stats count by a,b,c 

and if select date before 1st Jun 2024 i.e 30th May 2024 i would like to have stats group by field like below.

eventtype="abc" |stats count by a,d,e

So my current implementation is putting group by field in token, token will be set based on time selection and final query would be like below.

eventtype="abc" |stats count by $groupby_field$

Now the issue is splunk dashboard says waiting for input the moment i add token input to stats groupby field.

Appreciate your suggestion/help to handle this scenario.

 

Thanks,

Mani

 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you are changing the groupby_field token in the change handler of the time selection input, which is essentially the input that is being waited for, you could also initialise the groupby_field token in an init block in SimpleXML - it is perhaps a little more complicated to do in Studio

0 Karma

kasimanikandan
Engager

@ITWhisperer didnt worked 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

That sort of response is unlikely to elicit further help from anyone.

Please describe what you have done, and if possible post snippets of your token management logic in your dashboard

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...