Splunk Search

How can I use tokens in a stats function?

jedatt01
Builder

I want to use a dropdown to change the field that the stats command function uses in calcuation. my token is called my_token.

example:

index=myindex mysearch | stats dc($my_token$) by mylocation

Is this possible?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Short answer: yes.

Tokens are string-replaced before the search is run, you can use them anywhere in your search.

View solution in original post

gyslainlatsa
Motivator

hi,

it's possible,
try like this with that example using Dropdown

 <form>

<fieldset>

 <input type="time" token="field1">
   <label></label>
   <default>
     <earliest>0</earliest>
     <latest></latest>
   </default>
 </input>

<input type="dropdown" token="user" searchWhenChanged="true">
   <label>Select  a sourcetype:</label>
   <choice value="*">ALL</choice>
   <choice value="splunkd">splunkd</choice>
   <choice value="audittrail">audittrail</choice>
   <choice value="scheduler">scheduler</choice>
   <default>*</default>
 </input>

 </fieldset>

<row> 
 <panel>
   <event>
     <search>
       <query>index=* OR index=_* |stats dc($user$) by source</query>
       <earliest>$field1.earliest$</earliest>
       <latest>$field1.latest$</latest>
     </search>
     <option name="list.drilldown">full</option>
     <option name="list.wrap">1</option>
     <option name="maxLines">5</option>
     <option name="raw.drilldown">full</option>
     <option name="rowNumbers">0</option>
     <option name="table.drilldown">all</option>
     <option name="table.wrap">1</option>
     <option name="type">list</option>
     <option name="wrap">true</option>
     <option name="dataOverlayMode">none</option>
     <option name="count">10</option>
     <fields>["host","source","sourcetype"]</fields>
   </event>
 </panel>
</row>
 </form>

please forgive my english.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Short answer: yes.

Tokens are string-replaced before the search is run, you can use them anywhere in your search.

jkat54
SplunkTrust
SplunkTrust

If your token value has spaces in it.

Example: "this is the token value"

Then you'll want to put quotes around the token in your stats command.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...