Splunk Search

Using multiple Tokens in the same search

DavidHourani
Super Champion

Hello,

Is it possible to use multiple tokens in the same input ? if yes, how can i do so ?

I'm thinking it should look something like this:

< input type="radio" token="token1" token="token2">
  <default for token 1>count(request) AS value</default>
  <default for token 2>request</default>
  <choice value="count(request) AS Total" for token 1 && value="count(X) AS TotalX" for token 2>Choice1</choice>
  <choice value="sum(mbi) AS SUM" for token1 value="sum(Y) AS SUMY" for token2>Choice2</choice>
</input>

Hope the question isn't too tricky.

David

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I think what you're saying is that you want the action of selecting a single radio button to populate two different tokens at the same time. This is not possible in SimpleXML but you can do it in an HTML dashboard with syntax similar to:

<div id="myradiogroup"></div>

// Listen for changes to $token1And2$. Populate $token1$ and $token2$ appropriately.
mvc.Components.get('default').on('change:token1And2', function(defaultNamespace, token1And2) {
    var parts = token1And2.split('#');
    mvc.Components.get('default').set('token1', parts[0]);
    mvc.Components.get('default').set('token2', parts[1]);
});

new RadioGroupView({
    el: $('#myradiogroup'),
    choices: [
        'count(request) AS value#count(X) AS TotalX',
        'sum(mbi) AS SUM#sum(Y) AS SUMY'
    ],
    default: 'count(request) AS value#count(X) AS TotalX',
    value: mvc.tokenSafe('$token1And2$')
}).render();

// ... Create some components that use $token1$ and $token2$ ...

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".
So yeah "they will be used in the same search".

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I'm not quite sure what you're trying to do. However to answer your question directly, an input control can only have its value bound to a single token.

Other controls can have multiple properties bound to tokens or even have individual properties that are bound to multiple tokens. For example you can have code similar to:

<input type="text" token="index" label="Index Name"/>
<input type="text" token="maxResults" label="Max Results"/>
<search id="rows" query="index=$index$ | head $maxResults$"/>
<table searchid="rows"/>

NOTE: This syntax is only loosely approximate, since I am more familiar with HTML dashboards than Simple XML dashboards.

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".

0 Karma

somesoni2
Revered Legend

Will both the token be used in same search ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...