Splunk Search

Tokens

kwholley63
Loves-to-Learn Lots

I have a dashboard with two panels. One is sales data and one is returns. I would like to have a drop down that I enter the store number and it updates both panels with that number. In the query I have storeno= and the token should be passed to both query dashboards here. How do I do that?

 

thank you

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kwholley63 

Just take below xml as example and observe the `tkn_storeno` token. 

 

<form>
  <label>Token Usage</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_storeno" searchWhenChanged="true">
      <label>Store Number</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 | eval storeno=1 | accum storeno
| where storeno="$tkn_storeno$"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>| makeresults count=10 | eval storeno=1 | accum storeno
| where storeno="$tkn_storeno$" | stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

kwholley63
Loves-to-Learn Lots

Thank you for your reply. I'm still a bit confused, maybe I did not present this well. 

 

I have a query lets call it query1 that looks at sales and I have storenumber=1 in that query  I have query2 that looks at returns with storenumber=1 in the second query

I want to add these queries to my store's dashboard. Now in the dashboard, I want to have a box (text, dropdown, anything) where I can enter a new store number and run both those queries.

If I enter say 2 in that box how does that 2 get replaced in the queries where store number =1 to be storenumber=2 now?

I don't understand how modifying the underlying HTML does that. I thought it would be some token like variable?

 

Thank Yu for your time

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...