Dashboards & Visualizations

Tokens based on Tags

dperry
Communicator

I have a field value pair of the following:

node_primary_node_group_id=3
node_primary_node_group_id=4
node_primary_node_group_id=5
and so on....

I created a tag for these values. ex:
node_primary_node_group_id=3 (Web Servers)
node_primary_node_group_id=5 (App Servers)
node_primary_node_group_id=5 (DB Servers)

I want to create a token that would let the user see Dropdown Form Input Element with the tags I created - Web, App, and DB Server.

I think I understand the basixc syntax for a DropDown Form Input Element but not sure how to use tags. This is possible?

0 Karma
1 Solution

sundareshr
Legend

You may not need tags for this purpose. You can create a drop-down that is dynamically populated. Like this

<input type="dropdown" token="tokTag">
<search>
<query>index=xyz earliest=-1d@d | stats count by node_primary_node_group_id | eval tag=case(node_primary_node_group_id=1, "Web Servers", node_primary_node_group_id=2, "App Servers", node_primary_node_group_id=3, "DB Servers", 1=1, "UNK") | fields node_primary_node_group_id tag</query>
      <fieldForLabel>tag</fieldForLabel>
      <fieldForValue>node_primary_node_group_id</fieldForValue>
</input>

In the query for your dependent panel, use the tokTag, as the user selected value to filter your data. Like this

<search>
<query>index=xyz node_primary_node_group_id=$tokTag$" | ...</query>
</search>

View solution in original post

0 Karma

sundareshr
Legend

You may not need tags for this purpose. You can create a drop-down that is dynamically populated. Like this

<input type="dropdown" token="tokTag">
<search>
<query>index=xyz earliest=-1d@d | stats count by node_primary_node_group_id | eval tag=case(node_primary_node_group_id=1, "Web Servers", node_primary_node_group_id=2, "App Servers", node_primary_node_group_id=3, "DB Servers", 1=1, "UNK") | fields node_primary_node_group_id tag</query>
      <fieldForLabel>tag</fieldForLabel>
      <fieldForValue>node_primary_node_group_id</fieldForValue>
</input>

In the query for your dependent panel, use the tokTag, as the user selected value to filter your data. Like this

<search>
<query>index=xyz node_primary_node_group_id=$tokTag$" | ...</query>
</search>
0 Karma

dperry
Communicator

Thanks this is exactly what I was looking for !

0 Karma

dperry
Communicator

I'm getting an error parsing XML......for the last

0 Karma

dperry
Communicator
 <fieldForLabel>tag</fieldForLabel>
   <fieldForValue>node_primary_node_group_id</fieldForValue>
0 Karma

dperry
Communicator

Sorry for the confusion....typo. This works!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...