Getting Data In

Set token in the value of another token?

C_Sparn
Communicator

Hello,

I'm looking for a possibility to use one token $token2$ as part of the value of another token.
For example you have a dropdown input that is $token1$ and you want to set $token2$ as part of the value of one choice like this:

 <input type="dropdown" token="token1" searchWhenChanged="false">
  <label> any </label>
  <choice> value="field = $token2$">Test</choice>
</input>

If I now use $token1$ in my search string I just get the string "$token2$" and not the value of $token2$. Is there a possibility to get the value of $token2$ in the value of $token1$ in simple xml without using macros??
Thanks for help
Greetings

Tags (3)
1 Solution

somesoni2
Revered Legend

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

View solution in original post

somesoni2
Revered Legend

Try this sample (splunk 6 simple xml)

<form>
  <label>OneTokenAsValueForAnotherToken</label>
  <fieldset>
    <input type="dropdown" token="token2" searchWhenChanged="false">
      <label> any </label>
      <choice value="splunkd">splunkd</choice>
    </input>
    <input type="dropdown" token="token1" searchWhenChanged="false">
      <populatingSearch fieldForValue="Test" fieldForLabel="Test">
        <![CDATA[|stats count | eval Test="sourcetype=$token2$" ]]>
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <searchString>index=_internal $token1$| stats count by sourcetype</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
    </table>
  </row>
</form>

bnorthway
Path Finder

you are a freaking genius!

0 Karma

bnorthway
Path Finder

do you know how to re-run the search for token1 when the value for token2 changes?

0 Karma

kamal_jagga
Contributor

change value of searchWhenChanged to true. This will re-run search when value changes.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...