Is it possible to modify a form token's value after it is selected?

[vinay4444]

HI currently i am calling a splunk report with a parameter like below. Host is like ServerName.DatabaseName

<a href="http://XXXXX/en-US/app/search/database_monitoring_storage_02?form.Host=$Host$" class="btn btn-primary">Storage</a>

i want to include just ServerName in $Host$ while i call above how can i change this?

[somesoni2]

Try something like this for dropdown xml. The populating search for the dropdown with have two fields, one with servername and database (to be used as label) and one with servername only (to be used as value). Then `` element will define two new tokens from the label and value of the dropdown. Use the $HostName$ wherever you need both servername and database and use $Host$ where you need just the server name.

<fieldset submitButton="false">
   <input type="dropdown" token="host_tok" searchWhenChanged="true">
      <label>Host</label>
      <search>
        <query>
          Your query giving two fields  servernameWdatabase and  servernameOnly
        </query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>servernameWdatabase</fieldForLabel>
      <fieldForValue>servernameOnly</fieldForValue>

      <change>
          <set token="HostName">$label$</set>
          <set token="Host">$value$</set>
      </change>      
    </input>
  </fieldset>

[woodcock]

You can do it like this:

| noop | stats count AS HostFirstPart | eval junk=$Host$ | rex field=junk "(?<HostFirstPart>[^\.]+)" | map search="Put Your Real Search Here But Use $HostFirstPart$ Instead Of $Host$"

[vinay4444]

i want a way to have one part of token to be put in html area ( NOT SEARCH )

Storage

I am using above code in button that calls another dashboard

[vinay4444]

I want to use $HostFirstPart$ in XML when i call another dashboard with token not in search :

Storage

[woodcock]

I have no idea what your last comment means.

[vinay4444]

Hi this is from input ( drop down)

[somesoni2]

You can update the search that populates the dropdown to create another field with just the Server Name and Use the new field as "fieldforvalue". THis way the token $Host$ will have value as Server Name only.

[vinay4444]

but i am using $host$ in other charts where it needs servername.database name format only. only one place where i call another report (via button) i need servername alone.

[somesoni2]

From where are you getting the values for the $Host$ token? A search result OR form input?