Splunk Search

Using multiple Tokens in the same search

DavidHourani
Super Champion

Hello,

Is it possible to use multiple tokens in the same input ? if yes, how can i do so ?

I'm thinking it should look something like this:

< input type="radio" token="token1" token="token2">
  <default for token 1>count(request) AS value</default>
  <default for token 2>request</default>
  <choice value="count(request) AS Total" for token 1 && value="count(X) AS TotalX" for token 2>Choice1</choice>
  <choice value="sum(mbi) AS SUM" for token1 value="sum(Y) AS SUMY" for token2>Choice2</choice>
</input>

Hope the question isn't too tricky.

David

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I think what you're saying is that you want the action of selecting a single radio button to populate two different tokens at the same time. This is not possible in SimpleXML but you can do it in an HTML dashboard with syntax similar to:

<div id="myradiogroup"></div>

// Listen for changes to $token1And2$. Populate $token1$ and $token2$ appropriately.
mvc.Components.get('default').on('change:token1And2', function(defaultNamespace, token1And2) {
    var parts = token1And2.split('#');
    mvc.Components.get('default').set('token1', parts[0]);
    mvc.Components.get('default').set('token2', parts[1]);
});

new RadioGroupView({
    el: $('#myradiogroup'),
    choices: [
        'count(request) AS value#count(X) AS TotalX',
        'sum(mbi) AS SUM#sum(Y) AS SUMY'
    ],
    default: 'count(request) AS value#count(X) AS TotalX',
    value: mvc.tokenSafe('$token1And2$')
}).render();

// ... Create some components that use $token1$ and $token2$ ...

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".
So yeah "they will be used in the same search".

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I'm not quite sure what you're trying to do. However to answer your question directly, an input control can only have its value bound to a single token.

Other controls can have multiple properties bound to tokens or even have individual properties that are bound to multiple tokens. For example you can have code similar to:

<input type="text" token="index" label="Index Name"/>
<input type="text" token="maxResults" label="Max Results"/>
<search id="rows" query="index=$index$ | head $maxResults$"/>
<table searchid="rows"/>

NOTE: This syntax is only loosely approximate, since I am more familiar with HTML dashboards than Simple XML dashboards.

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".

0 Karma

somesoni2
Revered Legend

Will both the token be used in same search ?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...