I would like to use a lookup table with multiple columns to populate multiple fields for use later in a dashboard. Specifics look like this:
dropdown_input,index,sourcetype,source
value1,val1_data,val1_srctype,val1_source
value2,val2_data,val2_srctype,val2_source
I want to use the dropdown_input as a pulldown selector, and when submitted, to have $dropdown_input$, $index$, $sourcetype$, and $source$ available for use in SPL queries.
This should do:
<input type="dropdown" token="magic" searchWhenChanged="true">
<label>Choose Service</label>
<search>
<query>| inputlookup cerby.csv | eval magic = index . "#c#e#r#b#y#" . sourcetype . "#c#e#r#b#y#" . source</query>
</search>
<selectFirstChoice>true</selectFirstChoice>
<fieldForLabel>dropdown_input</fieldForLabel>
<fieldForValue>magic</fieldForValue>
<change>
<condition value="*">
<eval token="index">mvindex(split($value$, "#c#e#r#b#y#"), 0, 0)</eval>
<eval token="sourcetype">mvindex(split($value$, "#c#e#r#b#y#"), 1, 1)</eval>
<eval token="source">mvindex(split($value$, "#c#e#r#b#y#"), 2, 2)</eval>
</condition>
</change>
</input>
The input itself can only set one token, so this sets a magic token containing several tokens that then get extracted into individual tokens.
This should do:
<input type="dropdown" token="magic" searchWhenChanged="true">
<label>Choose Service</label>
<search>
<query>| inputlookup cerby.csv | eval magic = index . "#c#e#r#b#y#" . sourcetype . "#c#e#r#b#y#" . source</query>
</search>
<selectFirstChoice>true</selectFirstChoice>
<fieldForLabel>dropdown_input</fieldForLabel>
<fieldForValue>magic</fieldForValue>
<change>
<condition value="*">
<eval token="index">mvindex(split($value$, "#c#e#r#b#y#"), 0, 0)</eval>
<eval token="sourcetype">mvindex(split($value$, "#c#e#r#b#y#"), 1, 1)</eval>
<eval token="source">mvindex(split($value$, "#c#e#r#b#y#"), 2, 2)</eval>
</condition>
</change>
</input>
The input itself can only set one token, so this sets a magic token containing several tokens that then get extracted into individual tokens.
Are JS extensions in splunkjs an option or are you required to only use Simple XML?
Only Simple XML.