Is it possible to get dropdown token display name and value?

[biju_babu]

Hi 

I have a dropdown in my dashboard studio which has some static values like

TokenName: appName

Display Name	Value
App1	Value1
App2	Value2

In my search query, i need to use both display name and value. We can get the value using $appName$ but is it possible to also get display name?

Hoping for a help. Thanks

[gcusello]

Hi @biju_babu,

It isn't so immediate:

you should separate the label from the value, in other words, you should run in the dropdown  a search like the following:

your_search
| eval both_fields=Display_Name."|".Value
| table Display_Name Value

Than you should associate to the label the "Display_Name" field and to the value the "Value" field.

Then in the search you have to separate the two components of "both_fields" using a regex like this:

| rex field=both_fields "^(?<Display_Name>[^\|]*)\|(?<Value>.*)"

in this way you have in your search both Display_Value and Value.

Ciao.

Giuseppe

[biju_babu]

Actually, i want to set source as display_Name and use value in search

for example - 

index=main sourcetype="access_combined" source="App1" | search "Value1*"

is there any simple way to achieve this?

[gcusello · Accepted solution]

Ciao.

Giuseppe

The only way is the one described in my previous answer.

There could be another solution using two tokens with the second related to the first, something like this:

<form>
  <fieldset submitButton="false">
    <input type="dropdown" token="source">
      <label>source choose</label>
      <search>
        <query>
            index=your_index
            | dedup source
            | sort source
            | table source
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
    </input>
    <input type="dropdown" token="Value">
      <label>Value choose</label>
      <search>
        <query>
            index=your_index source="$source$"
            | dedup value
            | sort value
            | table value
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>value</fieldForLabel>
      <fieldForValue>value</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Title</title>
      <table>
        <search>
          <query>
            index=main sourcetype="access_combined" source="$source$" "$value$"
          </query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Ciao.

Giuseppe

[biju_babu]

Thanks Giuseppe. 

by the way i was using dashboard studio not the classic xml. I was thinking another way to do this by using token value as string with both values separated by some character (;) and use split method to get the value. I will check you method too.

Thanks a lot