Splunk Search

Why are Tokens not getting recalculated on changing the form value?

Ashwin3
Engager

Hi team,

As per my requirement, on changing a particular form element [Token 1] , a set of other tokens [Token2,Token3 ..etc] needs to be recalculated and set first and then on click of submit , all my panels should load using the recalculated tokens.

 

I have added the tokens to be evaluated with in the <change> tag under the <input> of the Token1.

But still if i change the form element value, the other tokens are not getting recalculated. Could you please help with this?

sample:

<input type="text" token="timeTokenMid" searchWhenChanged="false">
<label>Start Time</label>
<change>
<eval token="formatted_token">strptime($timeTokenMid$,"%m/%d/%Y:%T")</eval>
<eval token="timeTokenSt">relative_time($formatted_token$,"-1h")</eval>
<eval token="timeTokenSt_datetime">strftime($timeTokenSt$,"%m/%d/%Y:%T")</eval>
<eval token="timeTokenEnd">relative_time($formatted_token$,$obtDuration$)</eval>
<eval token="timeTokenEnd_datetime">strftime($timeTokenEnd$,"%m/%d/%Y:%T")</eval>
</change>

 

 

Labels (1)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You have searchWhenChanged="false", so in that case, when you change the token, it is will not be assigned to the token $timeTokenMid$, so the eval statement

<eval token="formatted_token">strptime($timeTokenMid$,"%m/%d/%Y:%T")</eval>

will not work. You need to use $value$ for that initial token setting. If you had searchWhenChanged="true", then your example would work, but when false, you need to use this technique.

Here's a full example

 

<form>
  <label>tst</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="timeTokenMid" searchWhenChanged="false">
      <label>Start Time - %m/%d/%Y:%T</label>
      <change>
        <eval token="formatted_token">strptime($value$,"%m/%d/%Y:%T")</eval>
        <eval token="timeTokenSt">relative_time($formatted_token$,"-1h")</eval>
        <eval token="timeTokenSt_datetime">strftime($timeTokenSt$,"%m/%d/%Y:%T")</eval>
        <eval token="timeTokenEnd">relative_time($formatted_token$,$obtDuration$)</eval>
        <eval token="timeTokenEnd_datetime">strftime($timeTokenEnd$,"%m/%d/%Y:%T")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| fields - _time
        | eval timeTokenMid=$timeTokenMid|s$
        | eval formatted_token=$formatted_token|s$
        | eval timeTokenSt=$timeTokenSt|s$
        | eval timeTokenSt_datetime=$timeTokenSt_datetime|s$
        | eval timeTokenEnd=$timeTokenEnd|s$
        | eval timeTokenEnd_datetime=$timeTokenEnd_datetime|s$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You need <condition /> under <change />.  See Conditional operations with form inputs (and Define conditional matching).

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...