Splunk Search

how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029
Communicator

Hi,Splunkers,

I have a dashboard with 2 Panels, which share one droplist  input.

droplist has  name/values  as  ALL/*,     a/a, b/b, c/c, etc.

for panel 1, whatever is selected,      | search  fieldname = $tokename$, 

but for panel 2, when ALL/* selected,   |search fieldname = $tokenname$ as panel1, but when other values are selected,  Iwant a  suffix  _CB  to be added at the end, for example, when   a/a selected,   search should be built like |search fieldname=a_CB.

thx in advance.

 

Kevin

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try if(value=="*",value,value."_CB")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set another token in the change handler of the dropdown to add the _CB to the dropdown token value.

0 Karma

wangkevin1029
Communicator

should I use  \ to convert *?   but I did try it  as below, doesn't work either.

<eval token="t_VQ_CB">if(match(value, "\*"),value, value+"_CB")</eval>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try if(value=="*",value,value."_CB")

0 Karma

wangkevin1029
Communicator

<eval token="t_VQ">if(value=="*",value,value)</eval>

I changed 1st token to  if...  like 2nd token, it looks it works fine.

will do more testing.

Btw, will this unnecessary "if" expression causes a little unnecessary performance issue?

 

Kevin

 

 

 

 
 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not significantly since it only evaluated when the input dropdown is evaluated

0 Karma

wangkevin1029
Communicator

Hi, ITWhisperer,

I did remember what you explained to me last time for that hidden feature in a text input.

not very familiar with the grammar here.

  <input type="dropdown" token="t_VQ_with2Handlers" searchWhenChanged="true">

      <label>Virtual Queue</label>

      <change>

        <eval token="t_VQ"></eval>   ( this one is for Panel1,  value no change), should I leave here blank?

        <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval>  (this one is for panel2, if value is *, keep value no change, if not *,  value+"_CB")

      </change>

      <default></default>

    </input>

 

I tried this, but doesn't work.

 

Kevin

0 Karma

wangkevin1029
Communicator

  <input type="dropdown" token="t_VQ_with2Handlers" searchWhenChanged="true">

      <label>Virtual Queue</label>

      <change>

        <eval token="t_VQ">t_VQ = t_VQ_with2Handlers</eval>     like this ?do I still need $ symbol? 

        <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval>  (this one is for panel2, if value is *, keep value no change, if not *,  value+"_CB")

      </change>

 

BTW,  is the 2nd <eval token-  correct? 

 

Kevin

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

The other eval looks like it might work

0 Karma

wangkevin1029
Communicator

Hi,ITWhisperer,

      <change>

        <eval token="t_VQ">$t_VQ_with2Handlers$</eval>  

        <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval> 

      </change>

1st token  t_VQ works as expected,  but 2nd token t_VQ_CB, 

| search VQ=$t_VQ_CB$   (VQ is the field name), 

 in the panel, why always showing  Search is waiting for input... it looks there is some syntax error?

 

Kevin

 

 

0 Karma

wangkevin1029
Communicator

or something wrong here?  only reselection of this dropdown can refresh value here? 

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

0 Karma

wangkevin1029
Communicator

Hi,ITWhisperer,

After more testing for token 1  t_VQ, 

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

I noticed when I load the dashboard at the beginning, the panel using this token also shows search is waiting for input  (default/initial value are ALL/*), 

I have to reselect other value, then change back to ALL/*,  then search works.

it's odd why initial load doesn't take dropdown selection? 

 

Kevin

 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I suspect it just a timing issue as it is loading the dashboard. You could try creating an init block at the top of the dashboard an initialise all the tokens to their default value

<init>
<set token="form.t_VQ_with2Handlers">*</set>
</init>

 

wangkevin1029
Communicator

Hi,ITWhisperer,

initial loading for token 2 works perfectly.

but for token 1,  after I added the following <init></init> at the top,  still showing  search waiting for input, and I can't open search to check how exactly the search is built.

<init>
<set token="form.t_VQ_with2Handlers">*</set>
</init>

 

Kevin

 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps if you could share your SimpleXML in a code block </> we might be able to spot what is going wrong?

0 Karma

wangkevin1029
Communicator

1st and 2nd panels using token 1 don't work.

3nd panel using token 2 works perfectly.

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Either change the token name for the dropdown to t_VQ or assign t_VQ the the value of the t_VQ_with2Handlers token

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...