Splunk Search

Tokens

kwholley63
Loves-to-Learn Lots

I have a dashboard with two panels. One is sales data and one is returns. I would like to have a drop down that I enter the store number and it updates both panels with that number. In the query I have storeno= and the token should be passed to both query dashboards here. How do I do that?

 

thank you

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kwholley63 

Just take below xml as example and observe the `tkn_storeno` token. 

 

<form>
  <label>Token Usage</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_storeno" searchWhenChanged="true">
      <label>Store Number</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 | eval storeno=1 | accum storeno
| where storeno="$tkn_storeno$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 | eval storeno=1 | accum storeno
| where storeno="$tkn_storeno$" | stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

kwholley63
Loves-to-Learn Lots

Thank you for your reply. I'm still a bit confused, maybe I did not present this well. 

 

I have a query lets call it query1 that looks at sales and I have storenumber=1 in that query  I have query2 that looks at returns with storenumber=1 in the second query

I want to add these queries to my store's dashboard. Now in the dashboard, I want to have a box (text, dropdown, anything) where I can enter a new store number and run both those queries.

If I enter say 2 in that box how does that 2 get replaced in the queries where store number =1 to be storenumber=2 now?

I don't understand how modifying the underlying HTML does that. I thought it would be some token like variable?

 

Thank Yu for your time

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...