I want to have a token for both the form input value and label fields which differ (fieldForValue, fieldForLabel), is it possible to do this? Or is there a way to access the label from a token (e.g., $token.label$ which I realize doesn't work, but similar to $time.earliest$)? Here's what I'm doing manually right now, but I don't want to have to have to add new conditions every time I update the lookup, which will grow quickly. <input type="dropdown" token="service"> <label>Select a Service:</label> <fieldForLabel>Domains</fieldForLabel> <fieldForValue>AFFECTED_ITEM_STRING</fieldForValue> <search> <query>| inputlookup domain_report.csv | table *</query> </search> <initialValue>*aura*</initialValue> <change> <condition label="Service1"> <set token="service_nm">Service1</set> </condition> <condition label="Service2"> <set token="service_nm">Service2</set> </condition> </change> </input> Thanks ... View more

I'd like to populate a dashboard in an app with a list of all ITSI KPI titles and their descriptions, so users will know what KPIs were used in the composite service health score. Is there a lookup or dataset I can access that has the KPI descriptions? I can get the list of KPI titles associated with a Service from the alarm_console_lookup, e.g.: | inputlookup alarm_console_lookup Is there a similar lookup that might also include the description text for each KPI? Thanks ... View more

Here's a small snippet of an xml firewall event i'm trying to parse: <response status="success"> <result> <thermal> <Slot1> <entry> <slot>1</slot> <description>Temperature @ Ocelot</description> <min>0.0</min> <max>60.0</max> <alarm>False</alarm> <DegreesC>36.0</DegreesC> </entry> <entry> <slot>1</slot> <description>Temperature @ Switch</description> <min>0.0</min> <max>60.0</max> <alarm>False</alarm> <DegreesC>37.5</DegreesC> </entry> </Slot1> </thermal> </result> </response> Ideally i'd like to set up a process to extract the two entries above as separate fields (Temp_Ocelot=36.0, Temp_Switch=37.5). I know I can do this with xpath at search time pretty easily as: ..... | xpath outfield=Temp_Ocelot "//response/result/thermal/Slot1/entry[description='Temperature @ Ocelot']/DegreesC" But i'd like to define this in the configuration files to parse out the fields automatically. For instance, here's how I set up a props.conf to extract the XML generically so that it extracts all possible fields: [pa_env] DATETIME_CONFIG = CURRENT KV_MODE = xml LINE_BREAKER = (<response>) MUST_BREAK_AFTER = \</response\> NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TRUNCATE = 0 pulldown_type = 1 But this leads to a lot of multivalue records, which I then have to deal with through mvzip, mvexpand, etc. Is there a way to set up props.conf (or additionally transforms.conf) to extract the individual tags of interest as individual fields? At first I thought I could do something with the FIELDALIAS in props.conf to extract a specific entry description following how it's done in xpath, but that didn't work. Here's what I tried: FIELDALIAS-rootfields = response.result.thermal.Slot1.entry[description='Temperature @ Ocelot'].DegreesC as Temp_Ocelot Is there a way to specify a specific tag based on its properties in a FIELDALIAS? Thanks ... View more