How to pass a field value to token in dashboard?

[edrivera3]

Hi
I have a dashboard with multiple panels and multiple input text tokens. In one of the panels, I extracted a field and I would like to use those field values to set a new token. I am not sure if this is possible. I read about using < seed>< \seed> in the documentation but I am not sure how I am suppose to use it because "seed" is defined inside< input>< /input>. I am interested in a solution inside the panel, if it is possible.

[jeffland]

Have you tried getting the search results from the search in Javascript, extracting the value you want and setting the search string by hand to contain the string? Should look something like this:

var search1 = splunkjs.mvc.Components.getInstance("searchThatProducesFieldname");
var search2 = splunkjs.mvc.Components.getInstance("searchThatusesFieldname");
var results = search1.data("results");
var stringYouAreLookingToUse = "";
results.on("data", function() {
     var rows = results.data().rows;
    // adjust to the proper result here:
    stringYouAreLookingToUse = rows[0][0];
    // insert your initial search string here
    search2.settings.set("search", 'index = foo | eval ' + stringYouAreLookingToUse + '=field | stats ...');
    search2.startSearch();
 });

Haven't tried this particular code out before posting, but should do the trick. If you want this in one and the same search, it could get a bit tricky.

[edrivera3]

I am not sure how I could add this javascript in the Splunk dashboard.

[jeffland]

Well, you need to include script=your_script_file.js in the dashboard or form tag of the XML code to reference the javascript file placed in %splunk_home%/etc/apps/appname/appserver/static (see here), and basically copy the code from above into that file (of course you also need to load libraries and dependencies for that file to work, see here for example). For another example on controling searches from js, see here. If you have never used js with splunk, I suggest you take a look here and do the tutorials.

[stephanefotso]

Hello!
Try this:

Extraction of fields|Search $token$ |continu my query

Example, let suppose that you have a token named token, and you want to search on it. here you go

......|rex "^Message=(?P<DocumentNum>[^,]+),\s+(?P<DocumentT>\w+\s+\w+\s+\w+)|search $token$|stats count by Document

[edrivera3]

This is not what I am looking for. In your example, you are just setting a input token which I already have in a different panel.

I am looking for something like this:
...| rex "blablabla(?< field>[bblabh])" | eval $token$=field %% (Panel A)

... | search $token$ %%(Panel b)

Basically, I want to set $token$ with values from field in panel A and use that token in panel B.

[stephanefotso]

Wo Wo Wo. I'm not sure it is possible. In fact, to affect a value to a token is not yet possible with splunk.
Thanks.

[_jgpm_]

I would like to do something similar to what @edrivera3 wants to do. I would like one panel on my dashboard to generate a value based on form input of the dashboard and then return a value that another panel (|savedsearch) would use to execute a search. Is this currently possible?