how to use one token with different evaluation for 2 panels query under different conditions.

[wangkevin1029]

Hi, Splunkers，

I have a dashboard with 2 panels.

there is one input token,  Gucid_token,

what I need is when Gucid_token is any string but not a 1 or 2 digits number, then use it as search string for panle1's query , in this case, this token has nothing to do with panel 2 query.

panel1

<query>sourcetype="omni:ors:voice" $Gucid_token$

Panel2

<query>sourcetype="omni:ors:voice"   keyword1 keyword2  | search skilllength >1 

when Gucid_token is a 1 or 2 digits number, then ignore it in panel1's query,  but for panel2's query, use this 

token to build search like  search skilllength > $Gucid_token$

panel1

<query>sourcetype="omni:ors:voice" 

Panel2

<query>sourcetype="omni:ors:voice"   keyword1 keyword2  | search skilllength > $Gucid_token$

thx in advance.

Kevin

[ITWhisperer]

In the change handler of the input, set up two tokens, one for each panel, based on the evaluation of the input.

[wangkevin1029]

I need a hidden feature from this input field.  that's why I don't want to use 2 inputs for this.

Kevin

[ITWhisperer]

You are not understanding what I am saying. In the change handler for the input, you can set multiple tokens. You still have one input and the hidden feature is that more than one token is set up when the input changes.

[wangkevin1029]

Ok, I kinda understand your suggestion.

you meant having this logic developed in input change handler, instead of in each panel's query.

but how to have 2 different handlers with two tokens in one input?

can you show me some sample code here?  I am a junior  splunker....

thx.

Kevin

[ITWhisperer]

    <input type="text" token="Gucid_token">
      <label>$Gucid_token$ - Panel 1 token: $panel1_token$ - Panel 2 token: $panel2_token$</label>
      <change>
        <eval token="panel1_token">if(match(value, "^[0-9][0-9]?$"),"", value)</eval>
        <eval token="panel2_token">if(match(value, "^[0-9][0-9]?$"),value, 1)</eval>
      </change>
    </input>

[wangkevin1029]

Besides,  my drilldown click is to open two dashboards, one is itself, the other one different dashboard, 

different dashboard got the passed cellvalue.

Kevin

[wangkevin1029]

BTW，  I clicked the same cell I always clicked..  so, the value is a valid value for panel query 1.

Kevin

[wangkevin1029]

 Hi, ITWhisperer,

since my original token name is Gucid_token, so, I still keep it for  panel 1 query,  in this way I don't have to change any other original code related to Gucid_token.

but then I noticed some drilldown click stop working, which tries to open the same dashboard.

why this   form.Gucid_token=$click.value2$  to pass cell value to open the same dashboard stop working?  

I attached the full open link at the bottom.

<input type="text" token="Gucid_token_with2handlers" searchWhenChanged="true">

      <label>Gucid/UUID/SID</label>

      <change>

        <eval token="Gucid_token">if(match(value, "^[0-9][0-9]?$"),"", value)</eval>

        <eval token="skillexpressionLength">if(match(value, "^[0-9][0-9]?$"),value, 0)</eval>

      </change>

      <default></default>

    </input>

  <drilldown>

          <link target="_blank">/abcabc/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token=$click.value2$</link>

        </drilldown>

kevin

[ITWhisperer · Accepted solution]

You changed the name of the input form token - try the drilldown like this

<link target="_blank">/abcabc/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token_with2handlers=$click.value2$</link>

[wangkevin1029]

it works, makes perfect sense....

one it global variable, the other two are local variables.

thanks again.

Kevin

[wangkevin1029]

thank you very much, works amazingly.... 

[wangkevin1029]

thank you very much, I will give a try.