Dashboards & Visualizations

Simple XML: Dynamic variables/value in choice tag

koshyk
Super Champion

hi,
I'm building a simple xml form so that user can select via dropdown. I've got a situation where the "Metric" logic is different. I'm currently trying to put the logic as choice value, but it doesn't not accept dynamic value (eg $Report_Type$). Hence during search, it comes up as $Report_Type$ instead of "ReportA". Any way to overcome this issue? (OR Any other method to set dynamic variable in simpleXML is also appreciated)

Example below

    <input type="radio" token="Report_Type" searchWhenChanged="true">
      <label>Select a Report:</label>
          <default>ReportA</default>

          <!-- Define the choices in code -->
          <choice value="ReportA">ReportA</choice>
          <choice value="ReportB">ReportB</choice>
    </input>

    <input type="dropdown" token="Metric" searchWhenChanged="true">
      <label>Select a Metric:</label>
          <default>Count</default>    
          <choice value="stats sum(count) by Time_Bucket,$Report_Type$| rename sum(count) as Customer_COUNT ">Count</choice>
          <choice value="eventstats max(count) as MAXVAL by $Report_Type$ | where (count=MAXVAL)| rename count as Customer_MAX_COUNT">Peak</choice>
    </input>        

    <row>
    <table>
    <searchPostProcess>$Metric$ ... Some other calculation</searchPostProcess>
      <option name="drilldown">off</option>
      <option name="showPager">true</option>
      <option name="count">20</option>
    </table>
  </row>
Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this (run anywhere xml code)

<form>
  <label>ReportType</label>
  <fieldset>
    <input type="radio" token="varIndex" searchWhenChanged="true">
      <label>Select an Index:</label>
      <default>_internal</default>
      <!-- Define the choices in code -->
      <choice value="_internal">_internal</choice>
      <choice value="main">main</choice>
    </input>
    <input type="dropdown" token="Metric" searchWhenChanged="true">
      <label>Select a Metric:</label>
      <default>Count</default>
      <populatingSearch fieldForLabel="key"  fieldForValue="value" >
        index="$varIndex$" | stats count as value | eval key="Count" | append [search index="$varIndex$" | stats count by date_mday | stats max(count) as value | eval key="Peak"]
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <title>Log events</title>
      <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>
  <row>
    <table>
      <title>Dropdown query</title>
      <searchString>index="$varIndex$" | stats count as value | eval key="Count" | append [search index="$varIndex$" | stats count by date_mday | stats max(count) as value | eval key="Peak"]</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>
</form>
0 Karma

DavidHourani
Super Champion

Why not combine both choices into the same dropdown list and have 4 choices instead of 2 like:

1- Count For ReportA

2- Peak For Report A

3- Count For Report B

4- Peak For Report B

You can also try troubleshooting to check if "report_Type" is actually taking the default value...try putin $Report_Type$ in a title or something just to make sure that you can read the choice you made...if you can't read the choice it's probably a problem with the radio button...try replacing it with a drowndown list if you want 🙂

0 Karma

tugnet
Explorer

did you find any solution? got the same problem 😕

0 Karma

koshyk
Super Champion

unfortunately, not. I had to switch to advanced XML (sidieviewutil) for this.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...