Splunk Search

Using multiple Tokens in the same search

DavidHourani
Super Champion

Hello,

Is it possible to use multiple tokens in the same input ? if yes, how can i do so ?

I'm thinking it should look something like this:

< input type="radio" token="token1" token="token2">
  <default for token 1>count(request) AS value</default>
  <default for token 2>request</default>
  <choice value="count(request) AS Total" for token 1 && value="count(X) AS TotalX" for token 2>Choice1</choice>
  <choice value="sum(mbi) AS SUM" for token1 value="sum(Y) AS SUMY" for token2>Choice2</choice>
</input>

Hope the question isn't too tricky.

David

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I think what you're saying is that you want the action of selecting a single radio button to populate two different tokens at the same time. This is not possible in SimpleXML but you can do it in an HTML dashboard with syntax similar to:

<div id="myradiogroup"></div>

// Listen for changes to $token1And2$. Populate $token1$ and $token2$ appropriately.
mvc.Components.get('default').on('change:token1And2', function(defaultNamespace, token1And2) {
    var parts = token1And2.split('#');
    mvc.Components.get('default').set('token1', parts[0]);
    mvc.Components.get('default').set('token2', parts[1]);
});

new RadioGroupView({
    el: $('#myradiogroup'),
    choices: [
        'count(request) AS value#count(X) AS TotalX',
        'sum(mbi) AS SUM#sum(Y) AS SUMY'
    ],
    default: 'count(request) AS value#count(X) AS TotalX',
    value: mvc.tokenSafe('$token1And2$')
}).render();

// ... Create some components that use $token1$ and $token2$ ...

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".
So yeah "they will be used in the same search".

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I'm not quite sure what you're trying to do. However to answer your question directly, an input control can only have its value bound to a single token.

Other controls can have multiple properties bound to tokens or even have individual properties that are bound to multiple tokens. For example you can have code similar to:

<input type="text" token="index" label="Index Name"/>
<input type="text" token="maxResults" label="Max Results"/>
<search id="rows" query="index=$index$ | head $maxResults$"/>
<table searchid="rows"/>

NOTE: This syntax is only loosely approximate, since I am more familiar with HTML dashboards than Simple XML dashboards.

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".

0 Karma

somesoni2
Revered Legend

Will both the token be used in same search ?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...