Splunk Search
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Help with token setting and unsetting

tomapatan
Contributor
‎09-18-2024 06:47 AM

Can`t seem to get my head round this one - I`ve got a table and would like the users to be able to click on a row and to add a Summary comment, but there`s a bug in the code. The comments get submitted BEFORE I click on the Submit button, which doesn`t seems to work anyway.

 

 

<form version="1.1" theme="light" script="TA-images_and-_files:tokenlinks.js">
  <label>Report</label>
  <search>
    <query>| makeresults|eval Date=strftime(_time,"%d/%m/%Y")|fields - _time</query>
    <done>
      <set token="defaut_time">$result.Date$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="date_tok" searchWhenChanged="true">
      <label>Date:</label>
      <fieldForLabel>Date</fieldForLabel>
      <fieldForValue>Date</fieldForValue>
      <search>
        <query>| makeresults
          | timechart span=1d count
          | sort - _time
          | eval Date=strftime(_time, "%d/%m/%Y"), earliest=relative_time(_time, "@d")
          | table Date, earliest
          | head 7
          | sort - earliest</query>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </search>
      <default>$defaut_time$</default>
    </input>
    <input type="dropdown" token="shift_tok" searchWhenChanged="true">
      <label>Shift:</label>
      <choice value="Day">Day</choice>
      <choice value="Night">Night</choice>
      <default>Day</default>
      <initialValue>Day</initialValue>
    </input>
  </fieldset>
  <row>
    <panel id="input_panel" depends="$show_input$">
      <input type="text" token="Summary">
        <label>Summary</label>
      </input>
      <input type="text" token="Date">
        <label>Date</label>
      </input>
      <input type="text" token="Time">
        <label>Time</label>
      </input>
      <input type="text" token="Shift">
        <label>Shift</label>
      </input>
      <html>

        <div>
          <button type="button" id="buttonId" class="btn btn-primary">Submit</button>
          <button style="margin-left:10px;" class="btn" data-token-json="{&quot;show_input&quot;: null}">Cancel</button>

        </div>
      </html>
    </panel>
  </row>

  <row depends="$hideMe$">
    <panel>
      <table>
        <search>
          <done>
            <unset token="form.Summary"></unset>
            <unset token="form.Date"></unset>
            <unset token="form.Time"></unset>
            <unset token="form.Shift"></unset>
            <unset token="show_input"></unset>
          </done>
          <query>| inputlookup handover_timeline_comments.csv
| append [
| makeresults | eval "Summary" = "$form.Summary$", Shift="$form.Shift$", Date="$form.Date$", Time="$form.Time$"
          ]
| outputlookup handover_timeline_comments.csv</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <refresh>30</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=24
| eval Date= "$date_tok$", Shift="$shift_tok$"
| streamstats count as Time
| eval Time=if(Time&lt;10, "0".Time.":00", Time.":00")

| eval Time=case(
   Shift == "Night" AND Time &gt;= "19:00", Time,
   Shift == "Day" AND Time &gt;= "07:00" AND Time &lt;= "18:00", Time,
   1==1, null )
| where isnotnull(Time)
| append [
   | makeresults count=24
   | streamstats count as Time
   | eval Time=if(Time&lt;10, "0".Time.":00", Time.":00")
   | table Time
   | eval Date= "$date_tok$", Shift="$shift_tok$"
   | eval Time=case(
      Shift == "Night" AND Time &lt;= "06:00", Time,
      1==1, null )
   | where isnotnull(Time)
]
| eval Summary=""
| fields - _time
| lookup handover_timeline_comments.csv Date Shift Time OUTPUT Summary
| eventstats last(Summary) as Summary by Date Shift Time</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <refresh>10s</refresh>
        </search>
        <option name="count">12</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="form.Date">$row.Date$</set>
          <set token="form.Shift">$row.Shift$</set>
          <set token="form.Time">$row.Time$</set>
          <set token="show_input">true</set>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

 

 

.js:

 

requirejs([
    '../app/simple_xml_examples/libs/jquery-3.6.0-umd-min',
    '../app/simple_xml_examples/libs/underscore-1.6.0-umd-min',
    'util/console',
    'splunkjs/mvc',
    'splunkjs/mvc/simplexml/ready!'
], function($, _, console, mvc) {
    function setToken(name, value) {
        console.log('Setting Token %o=%o', name, value);
        var defaultTokenModel = mvc.Components.get('default');
        if (defaultTokenModel) {
            defaultTokenModel.set(name, value);
        }
        var submittedTokenModel = mvc.Components.get('submitted');
        if (submittedTokenModel) {
            submittedTokenModel.set(name, value);
        }
    }
    $('.dashboard-body').on('click', '[data-set-token],[data-unset-token],[data-token-json]', function(e) {
        e.preventDefault();
        var target = $(e.currentTarget);
        var setTokenName = target.data('set-token');
        if (setTokenName) {
            setToken(setTokenName, target.data('value'));
        }
        var unsetTokenName = target.data('unset-token');
        if (unsetTokenName) {
            setToken(unsetTokenName, undefined);
        }
        var tokenJson = target.data('token-json');
        if (tokenJson) {
            try {
                if (_.isObject(tokenJson)) {
                    _(tokenJson).each(function(value, key) {
                        if (value === null) {
                            // Unset the token
                            setToken(key, undefined);
                        } else {
                            setToken(key, value);
                        }
                    });
                }
            } catch (e) {
                console.warn('Cannot parse token JSON: ', e);
            }
        }
    });
});

 

 

0 Karma
Reply

VatsalJagani
SplunkTrust
SplunkTrust
‎09-22-2024 08:56 AM

@tomapatan- I'm not 100% sure on what are you trying to do but what I can say is, you probably might not need JS file. Simple XML dashboard can do it without need of JS code.

This is just another example to explain you the usage. This example shows token on the Dropdown filter, but token on Table or Chart drilldown (on-click) would work the similar way. I'll put the reference doc below -

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/PanelreferenceforSimplifiedXML#drilldow...

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tkn_number">
      <label>field1</label>
      <default>3</default>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <search>
        <query>| makeresults count=10 | streamstats count</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <condition match="'value'==&quot;3&quot;">
          <set token="tkn_show">true</set>
        </condition>
        <condition>
          <unset token="tkn_show"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row depends="$tkn_show$">
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count by sourcetype</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

I hope this helps!!! Kindly upvote if it does!!

0 Karma
Reply
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...