Splunk Search

Tokens

kwholley63
Loves-to-Learn Lots

I have a dashboard with two panels. One is sales data and one is returns. I would like to have a drop down that I enter the store number and it updates both panels with that number. In the query I have storeno= and the token should be passed to both query dashboards here. How do I do that?

 

thank you

Labels (1)
Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kwholley63 

Just take below xml as example and observe the `tkn_storeno` token. 

 

<form>
  <label>Token Usage</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_storeno" searchWhenChanged="true">
      <label>Store Number</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 | eval storeno=1 | accum storeno
| where storeno="$tkn_storeno$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 | eval storeno=1 | accum storeno
| where storeno="$tkn_storeno$" | stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

kwholley63
Loves-to-Learn Lots

Thank you for your reply. I'm still a bit confused, maybe I did not present this well. 

 

I have a query lets call it query1 that looks at sales and I have storenumber=1 in that query  I have query2 that looks at returns with storenumber=1 in the second query

I want to add these queries to my store's dashboard. Now in the dashboard, I want to have a box (text, dropdown, anything) where I can enter a new store number and run both those queries.

If I enter say 2 in that box how does that 2 get replaced in the queries where store number =1 to be storenumber=2 now?

I don't understand how modifying the underlying HTML does that. I thought it would be some token like variable?

 

Thank Yu for your time

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...