Dashboards & Visualizations

Simple XML: Dynamic variables/value in choice tag

koshyk
Super Champion

hi,
I'm building a simple xml form so that user can select via dropdown. I've got a situation where the "Metric" logic is different. I'm currently trying to put the logic as choice value, but it doesn't not accept dynamic value (eg $Report_Type$). Hence during search, it comes up as $Report_Type$ instead of "ReportA". Any way to overcome this issue? (OR Any other method to set dynamic variable in simpleXML is also appreciated)

Example below

    <input type="radio" token="Report_Type" searchWhenChanged="true">
      <label>Select a Report:</label>
          <default>ReportA</default>

          <!-- Define the choices in code -->
          <choice value="ReportA">ReportA</choice>
          <choice value="ReportB">ReportB</choice>
    </input>

    <input type="dropdown" token="Metric" searchWhenChanged="true">
      <label>Select a Metric:</label>
          <default>Count</default>    
          <choice value="stats sum(count) by Time_Bucket,$Report_Type$| rename sum(count) as Customer_COUNT ">Count</choice>
          <choice value="eventstats max(count) as MAXVAL by $Report_Type$ | where (count=MAXVAL)| rename count as Customer_MAX_COUNT">Peak</choice>
    </input>        

    <row>
    <table>
    <searchPostProcess>$Metric$ ... Some other calculation</searchPostProcess>
      <option name="drilldown">off</option>
      <option name="showPager">true</option>
      <option name="count">20</option>
    </table>
  </row>
Tags (2)
0 Karma

somesoni2
Revered Legend

Try something like this (run anywhere xml code)

<form>
  <label>ReportType</label>
  <fieldset>
    <input type="radio" token="varIndex" searchWhenChanged="true">
      <label>Select an Index:</label>
      <default>_internal</default>
      <!-- Define the choices in code -->
      <choice value="_internal">_internal</choice>
      <choice value="main">main</choice>
    </input>
    <input type="dropdown" token="Metric" searchWhenChanged="true">
      <label>Select a Metric:</label>
      <default>Count</default>
      <populatingSearch fieldForLabel="key"  fieldForValue="value" >
        index="$varIndex$" | stats count as value | eval key="Count" | append [search index="$varIndex$" | stats count by date_mday | stats max(count) as value | eval key="Peak"]
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <title>Log events</title>
      <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>
  <row>
    <table>
      <title>Dropdown query</title>
      <searchString>index="$varIndex$" | stats count as value | eval key="Count" | append [search index="$varIndex$" | stats count by date_mday | stats max(count) as value | eval key="Peak"]</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>
</form>
0 Karma

DavidHourani
Super Champion

Why not combine both choices into the same dropdown list and have 4 choices instead of 2 like:

1- Count For ReportA

2- Peak For Report A

3- Count For Report B

4- Peak For Report B

You can also try troubleshooting to check if "report_Type" is actually taking the default value...try putin $Report_Type$ in a title or something just to make sure that you can read the choice you made...if you can't read the choice it's probably a problem with the radio button...try replacing it with a drowndown list if you want 🙂

0 Karma

tugnet
Explorer

did you find any solution? got the same problem 😕

0 Karma

koshyk
Super Champion

unfortunately, not. I had to switch to advanced XML (sidieviewutil) for this.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...