Splunk Search

Using multiple Tokens in the same search

DavidHourani
Super Champion

Hello,

Is it possible to use multiple tokens in the same input ? if yes, how can i do so ?

I'm thinking it should look something like this:

< input type="radio" token="token1" token="token2">
  <default for token 1>count(request) AS value</default>
  <default for token 2>request</default>
  <choice value="count(request) AS Total" for token 1 && value="count(X) AS TotalX" for token 2>Choice1</choice>
  <choice value="sum(mbi) AS SUM" for token1 value="sum(Y) AS SUMY" for token2>Choice2</choice>
</input>

Hope the question isn't too tricky.

David

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I think what you're saying is that you want the action of selecting a single radio button to populate two different tokens at the same time. This is not possible in SimpleXML but you can do it in an HTML dashboard with syntax similar to:

<div id="myradiogroup"></div>

// Listen for changes to $token1And2$. Populate $token1$ and $token2$ appropriately.
mvc.Components.get('default').on('change:token1And2', function(defaultNamespace, token1And2) {
    var parts = token1And2.split('#');
    mvc.Components.get('default').set('token1', parts[0]);
    mvc.Components.get('default').set('token2', parts[1]);
});

new RadioGroupView({
    el: $('#myradiogroup'),
    choices: [
        'count(request) AS value#count(X) AS TotalX',
        'sum(mbi) AS SUM#sum(Y) AS SUMY'
    ],
    default: 'count(request) AS value#count(X) AS TotalX',
    value: mvc.tokenSafe('$token1And2$')
}).render();

// ... Create some components that use $token1$ and $token2$ ...

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".
So yeah "they will be used in the same search".

0 Karma

dfoster_splunk
Splunk Employee
Splunk Employee

I'm not quite sure what you're trying to do. However to answer your question directly, an input control can only have its value bound to a single token.

Other controls can have multiple properties bound to tokens or even have individual properties that are bound to multiple tokens. For example you can have code similar to:

<input type="text" token="index" label="Index Name"/>
<input type="text" token="maxResults" label="Max Results"/>
<search id="rows" query="index=$index$ | head $maxResults$"/>
<table searchid="rows"/>

NOTE: This syntax is only loosely approximate, since I am more familiar with HTML dashboards than Simple XML dashboards.

DavidHourani
Super Champion

Actually the problem here is that i need two tokens to be linked to the same set of radio buttons. I don't want to have two radio button columns displaying the same values.
So lets say i have choice A B C in a radio button list, if you click A one token will be used to display the value and the other to "count" whereas if u chose B one token will be used to display the value whereas the other will be used to "Sum".

0 Karma

somesoni2
Revered Legend

Will both the token be used in same search ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...