Dashboards & Visualizations

label usage in dashboard

pipipipi
Path Finder

Hi all,

I have dropdown input in my dashboard.

    <input type="dropdown" token="test" searchWhenChanged="false">
    <label>test</label>
    <choice value="hogehogehoge">ALL</choice>
    <choice value="hogehogehoge">ALL2</choice>
    <choice value="hogehogehoge">ALL3</choice>
    <default>ALL</default>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <change>
    <set token="label1">$label$</set>
</change>

I want use label value(like ALL, ALL2, ALL3) in my base search.
(this is example)

|makeresult 
[|eval test1="$label1$"]

but this eval command has no value.
How to get $label$ in eval command?

Thank you for helping me.

0 Karma

to4kawa
Ultra Champion
<form>
  <label>dropdown</label>
  <search id="base">
    <query>
         |makeresults 
   |eval command="sendmail"
      </query>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="hogehogehoge1">ALL</choice>
      <choice value="hogehogehoge2">ALL2</choice>
      <choice value="hogehogehoge3">ALL3</choice>
      <default>ALL</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <set token="label1">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base">
          <query>|eval to="hogehoge", subject="test", message="select is $label1$"</query>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

How about this?

0 Karma

vnravikumar
Champion

Hi

Can you please check the below code and let me know what issues are you facing.

<form>
  <label>dropdown</label>
  <search id="base">
    <query>
       |makeresults 
 |eval test1="$label1$"
    </query>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="test" searchWhenChanged="true">
      <label>test</label>
      <choice value="hogehogehoge1">ALL</choice>
      <choice value="hogehogehoge2">ALL2</choice>
      <choice value="hogehogehoge3">ALL3</choice>
      <default>ALL</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <change>
        <set token="label1">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base">

        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

pipipipi
Path Finder

Thank you for helping me.

  <form>
   <label>dropdown</label>
   <search id="base">
     <query>
        |makeresults 
  |eval test1="$label1$"
     </query>
   </search>
<search base="base"><query>
    |sendemail to="hogehoge" subject="test" message="select is $result.test1$"</query></search>
   <fieldset submitButton="true" autoRun="true">
     <input type="dropdown" token="test" searchWhenChanged="false>
       <label>test</label>
       <choice value="hogehogehoge1">ALL</choice>
       <choice value="hogehogehoge2">ALL2</choice>
       <choice value="hogehogehoge3">ALL3</choice>
       <default>ALL</default>
       <prefix>(</prefix>
       <suffix>)</suffix>
       <change>
         <set token="label1">$label$</set>
       </change>
     </input>
   </fieldset>
 </form>

I want to put label value in my email message, but there is no value in my message.
if I put message="select is $label1$"
sendemail command execute twice.

0 Karma

vnravikumar
Champion

You can directly access the token label1, right without base search?

0 Karma

pipipipi
Path Finder

I think so.
if I put message="select is $label1$", email message is select is ALL.
(but I recieve 2 emails.....)

0 Karma

vnravikumar
Champion

can you make autoRun="false" and try it

0 Karma

pipipipi
Path Finder

It does not work.
When I remove $label$
Just 1 email. I have no idea,

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...