Splunk Search

Is it possible to get dropdown token display name and value?

biju_babu
Explorer

Hi 

I have a dropdown in my dashboard studio which has some static values like

TokenName: appName

Display Name Value
App1 Value1
App2 Value2

 

In my search query, i need to use both display name and value. We can get the value using $appName$ but is it possible to also get display name?

Hoping for a help. Thanks

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Ciao.

Giuseppe

The only way is the one described in my previous answer.

There could be another solution using two tokens with the second related to the first, something like this:

<form>
  <fieldset submitButton="false">
    <input type="dropdown" token="source">
      <label>source choose</label>
      <search>
        <query>
            index=your_index
            | dedup source
            | sort source
            | table source
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
    </input>
    <input type="dropdown" token="Value">
      <label>Value choose</label>
      <search>
        <query>
            index=your_index source="$source$"
            | dedup value
            | sort value
            | table value
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>value</fieldForLabel>
      <fieldForValue>value</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Title</title>
      <table>
        <search>
          <query>
            index=main sourcetype="access_combined" source="$source$" "$value$"
          </query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @biju_babu,

It isn't so immediate:

you should separate the label from the value, in other words, you should run in the dropdown  a search like the following:

your_search
| eval both_fields=Display_Name."|".Value
| table Display_Name Value

Than you should associate to the label the "Display_Name" field and to the value the "Value" field.

Then in the search you have to separate the two components of "both_fields" using a regex like this:

| rex field=both_fields "^(?<Display_Name>[^\|]*)\|(?<Value>.*)"

in this way you have in your search both Display_Value and Value.

Ciao.

Giuseppe

0 Karma

biju_babu
Explorer

Actually, i want to set source as display_Name and use value in search

for example - 

index=main sourcetype="access_combined" source="App1" | search "Value1*"

is there any simple way to achieve this?

 

0 Karma

gcusello
Esteemed Legend

Ciao.

Giuseppe

The only way is the one described in my previous answer.

There could be another solution using two tokens with the second related to the first, something like this:

<form>
  <fieldset submitButton="false">
    <input type="dropdown" token="source">
      <label>source choose</label>
      <search>
        <query>
            index=your_index
            | dedup source
            | sort source
            | table source
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
    </input>
    <input type="dropdown" token="Value">
      <label>Value choose</label>
      <search>
        <query>
            index=your_index source="$source$"
            | dedup value
            | sort value
            | table value
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>value</fieldForLabel>
      <fieldForValue>value</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Title</title>
      <table>
        <search>
          <query>
            index=main sourcetype="access_combined" source="$source$" "$value$"
          </query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Ciao.

Giuseppe

biju_babu
Explorer

Thanks Giuseppe. 

by the way i was using dashboard studio not the classic xml. I was thinking another way to do this by using token value as string with both values separated by some character (;) and use split method to get the value. I will check you method too.

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...