Splunk Search

how to have one droplist input used for 2 panels with adding suffix for one panel?

wangkevin1029
Path Finder

Hi,Splunkers,

I have a dashboard with 2 Panels, which share one droplist  input.

droplist has  name/values  as  ALL/*,     a/a, b/b, c/c, etc.

for panel 1, whatever is selected,      | search  fieldname = $tokename$, 

but for panel 2, when ALL/* selected,   |search fieldname = $tokenname$ as panel1, but when other values are selected,  Iwant a  suffix  _CB  to be added at the end, for example, when   a/a selected,   search should be built like |search fieldname=a_CB.

thx in advance.

 

Kevin

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try if(value=="*",value,value."_CB")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set another token in the change handler of the dropdown to add the _CB to the dropdown token value.

0 Karma

wangkevin1029
Path Finder

should I use  \ to convert *?   but I did try it  as below, doesn't work either.

<eval token="t_VQ_CB">if(match(value, "\*"),value, value+"_CB")</eval>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try if(value=="*",value,value."_CB")

0 Karma

wangkevin1029
Path Finder

<eval token="t_VQ">if(value=="*",value,value)</eval>

I changed 1st token to  if...  like 2nd token, it looks it works fine.

will do more testing.

Btw, will this unnecessary "if" expression causes a little unnecessary performance issue?

 

Kevin

 

 

 

 
 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not significantly since it only evaluated when the input dropdown is evaluated

0 Karma

wangkevin1029
Path Finder

Hi, ITWhisperer,

I did remember what you explained to me last time for that hidden feature in a text input.

not very familiar with the grammar here.

  <input type="dropdown" token="t_VQ_with2Handlers" searchWhenChanged="true">

      <label>Virtual Queue</label>

      <change>

        <eval token="t_VQ"></eval>   ( this one is for Panel1,  value no change), should I leave here blank?

        <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval>  (this one is for panel2, if value is *, keep value no change, if not *,  value+"_CB")

      </change>

      <default></default>

    </input>

 

I tried this, but doesn't work.

 

Kevin

0 Karma

wangkevin1029
Path Finder

  <input type="dropdown" token="t_VQ_with2Handlers" searchWhenChanged="true">

      <label>Virtual Queue</label>

      <change>

        <eval token="t_VQ">t_VQ = t_VQ_with2Handlers</eval>     like this ?do I still need $ symbol? 

        <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval>  (this one is for panel2, if value is *, keep value no change, if not *,  value+"_CB")

      </change>

 

BTW,  is the 2nd <eval token-  correct? 

 

Kevin

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

The other eval looks like it might work

0 Karma

wangkevin1029
Path Finder

Hi,ITWhisperer,

      <change>

        <eval token="t_VQ">$t_VQ_with2Handlers$</eval>  

        <eval token="t_VQ_CB">if(match(value, "*"),value, value+"_CB")</eval> 

      </change>

1st token  t_VQ works as expected,  but 2nd token t_VQ_CB, 

| search VQ=$t_VQ_CB$   (VQ is the field name), 

 in the panel, why always showing  Search is waiting for input... it looks there is some syntax error?

 

Kevin

 

 

0 Karma

wangkevin1029
Path Finder

or something wrong here?  only reselection of this dropdown can refresh value here? 

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

0 Karma

wangkevin1029
Path Finder

Hi,ITWhisperer,

After more testing for token 1  t_VQ, 

<eval token="t_VQ">$t_VQ_with2Handlers$</eval>

I noticed when I load the dashboard at the beginning, the panel using this token also shows search is waiting for input  (default/initial value are ALL/*), 

I have to reselect other value, then change back to ALL/*,  then search works.

it's odd why initial load doesn't take dropdown selection? 

 

Kevin

 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I suspect it just a timing issue as it is loading the dashboard. You could try creating an init block at the top of the dashboard an initialise all the tokens to their default value

<init>
<set token="form.t_VQ_with2Handlers">*</set>
</init>

 

wangkevin1029
Path Finder

Hi,ITWhisperer,

initial loading for token 2 works perfectly.

but for token 1,  after I added the following <init></init> at the top,  still showing  search waiting for input, and I can't open search to check how exactly the search is built.

<init>
<set token="form.t_VQ_with2Handlers">*</set>
</init>

 

Kevin

 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps if you could share your SimpleXML in a code block </> we might be able to spot what is going wrong?

0 Karma

wangkevin1029
Path Finder

1st and 2nd panels using token 1 don't work.

3nd panel using token 2 works perfectly.

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Either change the token name for the dropdown to t_VQ or assign t_VQ the the value of the t_VQ_with2Handlers token

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...