Splunk Search

Using multiple Tokens in the same search

DavidHourani
Super Champion

Hello,

Is it possible to use multiple tokens in the same input ? if yes, how can i do so ?

I'm thinking it should look something like this:

< input type="radio" token="token1" token="token2">
  <default for token 1>count(request) AS value</default>
  <default for token 2>request</default>
  <choice value="count(request) AS Total" for token 1 && value="count(X) AS TotalX" for token 2>Choice1</choice>
  <choice value="sum(mbi) AS SUM" for token1 value="sum(Y) AS SUMY" for token2>Choice2</choice>
</input>

Hope the question isn't too tricky.

David

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I think what you're saying is that you want the action of selecting a single radio button to populate two different tokens at the same time. This is not possible in SimpleXML but you can do it in an HTML dashboard with syntax similar to:

<div id="myradiogroup"></div>

// Listen for changes to $token1And2$. Populate $token1$ and $token2$ appropriately.
mvc.Components.get('default').on('change:token1And2', function(defaultNamespace, token1And2) {
    var parts = token1And2.split('#');
    mvc.Components.get('default').set('token1', parts[0]);
    mvc.Components.get('default').set('token2', parts[1]);
});

new RadioGroupView({
    el: $('#myradiogroup'),
    choices: [
        'count(request) AS value#count(X) AS TotalX',
        'sum(mbi) AS SUM#sum(Y) AS SUMY'
    ],
    default: 'count(request) AS value#count(X) AS TotalX',
    value: mvc.tokenSafe('$token1And2$')
}).render();

// ... Create some components that use $token1$ and $token2$ ...

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".
So yeah "they will be used in the same search".

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I'm not quite sure what you're trying to do. However to answer your question directly, an input control can only have its value bound to a single token.

Other controls can have multiple properties bound to tokens or even have individual properties that are bound to multiple tokens. For example you can have code similar to:

<input type="text" token="index" label="Index Name"/>
<input type="text" token="maxResults" label="Max Results"/>
<search id="rows" query="index=$index$ | head $maxResults$"/>
<table searchid="rows"/>

NOTE: This syntax is only loosely approximate, since I am more familiar with HTML dashboards than Simple XML dashboards.

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".

0 Karma

somesoni2
Revered Legend

Will both the token be used in same search ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2026-2027 SplunkTrust is officially open. If ...