Splunk Search

Why are Tokens not getting recalculated on changing the form value?

Ashwin3
Engager

Hi team,

As per my requirement, on changing a particular form element [Token 1] , a set of other tokens [Token2,Token3 ..etc] needs to be recalculated and set first and then on click of submit , all my panels should load using the recalculated tokens.

 

I have added the tokens to be evaluated with in the <change> tag under the <input> of the Token1.

But still if i change the form element value, the other tokens are not getting recalculated. Could you please help with this?

sample:

<input type="text" token="timeTokenMid" searchWhenChanged="false">
<label>Start Time</label>
<change>
<eval token="formatted_token">strptime($timeTokenMid$,"%m/%d/%Y:%T")</eval>
<eval token="timeTokenSt">relative_time($formatted_token$,"-1h")</eval>
<eval token="timeTokenSt_datetime">strftime($timeTokenSt$,"%m/%d/%Y:%T")</eval>
<eval token="timeTokenEnd">relative_time($formatted_token$,$obtDuration$)</eval>
<eval token="timeTokenEnd_datetime">strftime($timeTokenEnd$,"%m/%d/%Y:%T")</eval>
</change>

 

 

Labels (1)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You have searchWhenChanged="false", so in that case, when you change the token, it is will not be assigned to the token $timeTokenMid$, so the eval statement

<eval token="formatted_token">strptime($timeTokenMid$,"%m/%d/%Y:%T")</eval>

will not work. You need to use $value$ for that initial token setting. If you had searchWhenChanged="true", then your example would work, but when false, you need to use this technique.

Here's a full example

 

<form>
  <label>tst</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="timeTokenMid" searchWhenChanged="false">
      <label>Start Time - %m/%d/%Y:%T</label>
      <change>
        <eval token="formatted_token">strptime($value$,"%m/%d/%Y:%T")</eval>
        <eval token="timeTokenSt">relative_time($formatted_token$,"-1h")</eval>
        <eval token="timeTokenSt_datetime">strftime($timeTokenSt$,"%m/%d/%Y:%T")</eval>
        <eval token="timeTokenEnd">relative_time($formatted_token$,$obtDuration$)</eval>
        <eval token="timeTokenEnd_datetime">strftime($timeTokenEnd$,"%m/%d/%Y:%T")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| fields - _time
        | eval timeTokenMid=$timeTokenMid|s$
        | eval formatted_token=$formatted_token|s$
        | eval timeTokenSt=$timeTokenSt|s$
        | eval timeTokenSt_datetime=$timeTokenSt_datetime|s$
        | eval timeTokenEnd=$timeTokenEnd|s$
        | eval timeTokenEnd_datetime=$timeTokenEnd_datetime|s$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You need <condition /> under <change />.  See Conditional operations with form inputs (and Define conditional matching).

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...