Splunk Enterprise Security

How do you pass the same token for two panels with one drop-down input?

bhaskarasplunk
Explorer

I want to pass a token from one panel to another panel. I mean, if I give one input in the drop down, it has to update both the panels in the same dashboard. Basically, the same token is used by two panels but I don't want give the same input twice by two drop-downs. My token is the same for the two panels ( Token1-Panel 1 and Token1-panel 2).

Can you please provide me with some example code that I can update in my panels?

0 Karma
1 Solution

renjith_nair
Legend

@bhaskarasplunk ,

Just reuse the token in the panels.

Whenever the drop down is changed, same value is displayed in both panels.

<form>
  <label>SIngle Token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok">
      <label>Value</label>
      <choice value="A">A</choice>
      <choice value="B">B</choice>
      <default>A</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>PANEL 1</title>
      <single>
        <search>
          <query>|makeresults| eval data="$tok$"|fields data</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="showTrendIndicator">0</option>
      </single>
    </panel>
    <panel>
      <title>PANEL 2</title>
      <single>
        <search>
          <query>|makeresults| eval data="$tok$"|fields data</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="showTrendIndicator">0</option>
      </single>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

renjith_nair
Legend

@bhaskarasplunk ,

Just reuse the token in the panels.

Whenever the drop down is changed, same value is displayed in both panels.

<form>
  <label>SIngle Token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tok">
      <label>Value</label>
      <choice value="A">A</choice>
      <choice value="B">B</choice>
      <default>A</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>PANEL 1</title>
      <single>
        <search>
          <query>|makeresults| eval data="$tok$"|fields data</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="showTrendIndicator">0</option>
      </single>
    </panel>
    <panel>
      <title>PANEL 2</title>
      <single>
        <search>
          <query>|makeresults| eval data="$tok$"|fields data</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="showTrendIndicator">0</option>
      </single>
    </panel>
  </row>
</form>
Happy Splunking!

bhaskarasplunk
Explorer

Thank you.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...