How to use token value in stats group by field in Splunk dashboard

[kasimanikandan]

Hi Team,

I have stats group by fields as token it will change dynamically based on time selection. for example if select since 1st Jun 24 then my query will be like below.

eventtype="abc" |stats count by a,b,c 

and if select date before 1st Jun 2024 i.e 30th May 2024 i would like to have stats group by field like below.

eventtype="abc" |stats count by a,d,e

So my current implementation is putting group by field in token, token will be set based on time selection and final query would be like below.

eventtype="abc" |stats count by $groupby_field$

Now the issue is splunk dashboard says waiting for input the moment i add token input to stats groupby field.

Appreciate your suggestion/help to handle this scenario.

Thanks,

Mani

[ITWhisperer]

Assuming you are changing the groupby_field token in the change handler of the time selection input, which is essentially the input that is being waited for, you could also initialise the groupby_field token in an init block in SimpleXML - it is perhaps a little more complicated to do in Studio

[kasimanikandan]

@ITWhisperer didnt worked 

[bowesmana]

That sort of response is unlikely to elicit further help from anyone.

Please describe what you have done, and if possible post snippets of your token management logic in your dashboard