Hi,
If your are fine with using javascript, below code will work,
<form script="default_token.js">
<label>Default Token</label>
<fieldset submitButton="true">
<input type="text" token="token1">
<label>Field</label>
</input>
</fieldset>
<row>
<panel>
<title>Default Token</title>
<table>
<search>
<query>index=_internal sourcetype=$token1$ | head 1 | table _time, _raw</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>
default_token.js
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView, SearchManager) {
var tokens = mvc.Components.get("default");
$(document).on("click", "#submit", function(e){
var tok1 = tokens.get("token1");
if (tok1 == undefined || tok1 == ""){
tokens.set("token1", "*");
}
});
});
... View more