Splunk Search

Tokens

kwholley63
Loves-to-Learn Lots

I have a dashboard with two panels. One is sales data and one is returns. I would like to have a drop down that I enter the store number and it updates both panels with that number. In the query I have storeno= and the token should be passed to both query dashboards here. How do I do that?

 

thank you

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kwholley63 

Just take below xml as example and observe the `tkn_storeno` token. 

 

<form>
  <label>Token Usage</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_storeno" searchWhenChanged="true">
      <label>Store Number</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 | eval storeno=1 | accum storeno
| where storeno="$tkn_storeno$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 | eval storeno=1 | accum storeno
| where storeno="$tkn_storeno$" | stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

kwholley63
Loves-to-Learn Lots

Thank you for your reply. I'm still a bit confused, maybe I did not present this well. 

 

I have a query lets call it query1 that looks at sales and I have storenumber=1 in that query  I have query2 that looks at returns with storenumber=1 in the second query

I want to add these queries to my store's dashboard. Now in the dashboard, I want to have a box (text, dropdown, anything) where I can enter a new store number and run both those queries.

If I enter say 2 in that box how does that 2 get replaced in the queries where store number =1 to be storenumber=2 now?

I don't understand how modifying the underlying HTML does that. I thought it would be some token like variable?

 

Thank Yu for your time

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...