Splunk Search

Why are Tokens not getting recalculated on changing the form value?

Ashwin3
Engager

Hi team,

As per my requirement, on changing a particular form element [Token 1] , a set of other tokens [Token2,Token3 ..etc] needs to be recalculated and set first and then on click of submit , all my panels should load using the recalculated tokens.

 

I have added the tokens to be evaluated with in the <change> tag under the <input> of the Token1.

But still if i change the form element value, the other tokens are not getting recalculated. Could you please help with this?

sample:

<input type="text" token="timeTokenMid" searchWhenChanged="false">
<label>Start Time</label>
<change>
<eval token="formatted_token">strptime($timeTokenMid$,"%m/%d/%Y:%T")</eval>
<eval token="timeTokenSt">relative_time($formatted_token$,"-1h")</eval>
<eval token="timeTokenSt_datetime">strftime($timeTokenSt$,"%m/%d/%Y:%T")</eval>
<eval token="timeTokenEnd">relative_time($formatted_token$,$obtDuration$)</eval>
<eval token="timeTokenEnd_datetime">strftime($timeTokenEnd$,"%m/%d/%Y:%T")</eval>
</change>

 

 

Labels (1)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You have searchWhenChanged="false", so in that case, when you change the token, it is will not be assigned to the token $timeTokenMid$, so the eval statement

<eval token="formatted_token">strptime($timeTokenMid$,"%m/%d/%Y:%T")</eval>

will not work. You need to use $value$ for that initial token setting. If you had searchWhenChanged="true", then your example would work, but when false, you need to use this technique.

Here's a full example

 

<form>
  <label>tst</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="timeTokenMid" searchWhenChanged="false">
      <label>Start Time - %m/%d/%Y:%T</label>
      <change>
        <eval token="formatted_token">strptime($value$,"%m/%d/%Y:%T")</eval>
        <eval token="timeTokenSt">relative_time($formatted_token$,"-1h")</eval>
        <eval token="timeTokenSt_datetime">strftime($timeTokenSt$,"%m/%d/%Y:%T")</eval>
        <eval token="timeTokenEnd">relative_time($formatted_token$,$obtDuration$)</eval>
        <eval token="timeTokenEnd_datetime">strftime($timeTokenEnd$,"%m/%d/%Y:%T")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| fields - _time
        | eval timeTokenMid=$timeTokenMid|s$
        | eval formatted_token=$formatted_token|s$
        | eval timeTokenSt=$timeTokenSt|s$
        | eval timeTokenSt_datetime=$timeTokenSt_datetime|s$
        | eval timeTokenEnd=$timeTokenEnd|s$
        | eval timeTokenEnd_datetime=$timeTokenEnd_datetime|s$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You need <condition /> under <change />.  See Conditional operations with form inputs (and Define conditional matching).

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...