Re: How to modify a token based on the value of an...

a238574 · ‎03-02-2018

I have a dashboard where I want to allow the user to search by either an Account # or a Business Unit name( serveral accts).

I have a text input to allow for Acct # entry(default *) and a dropdown to allow for BU Selection.

<input type="text" token="accountid">
  <label>Enter Account ID (default all)</label>
  <default>*</default>
  <prefix>AccountId=</prefix>
</input>
<input type="dropdown" token="BUName" searchWhenChanged="true">
  <label>Business Unit</label>
  <fieldForLabel>BU</fieldForLabel>
  <fieldForValue>BU</fieldForValue>
  <search>
    <query>source="xxxxxxxxxxx" | stats count by BU | table BU</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
  <choice value="All">All</choice>
  <default>*</default>
</input>

I am trying to use the same panel for both results. what I would like to be able to do is modify the accountid token if the BUName token is not set to "All". I have tried a couple of times but having issues on where in the dashboard code I can modify the token value using a condition match

niketn · ‎03-04-2018

[Updated Answer as per the details]

Reversed the condition block to override the token when Selected Business Unit is not All.

@a238574, based on sample Simple XML code and description provided try the following RUn Anywhere Dashboard. When you select All option for Business Unit, the Text Box token is overridden using Business Unit dropdown label in the <change> event handler. Please try out and confirm.

PS: I have added a static choice Dummy Test Value for testing Business Unit <choice value="Dummy Test">Dummy value for testing</choice>

<dashboard>
  <label>Modify Token Based on another</label>
  <fieldset>
   <input type="text" token="accountid">
     <label>Enter Account ID (default all)</label>
     <default>*</default>
     <prefix>AccountId=</prefix>
   </input>
   <input type="dropdown" token="BUName" searchWhenChanged="true">
     <label>Business Unit</label>
     <fieldForLabel>BU</fieldForLabel>
     <fieldForValue>BU</fieldForValue>
     <search>
       <query>source="xxxxxxxxxxx" | stats count by BU | table BU</query>
       <earliest>-24h@h</earliest>
       <latest>now</latest>
     </search>
     <choice value="All">All</choice>
     <choice value="Dummy Test">Dummy value for testing</choice>
     <default>*</default>
      <change>
        <condition value="All">
          <!-- Else Leave Account ID Text Box Value As Is -->
        </condition>
        <condition>
          <!-- Selected BU Name is not All -->
          <set token="accountid">YourTokenValueHere</set>
          <set token="form.accountid">YourTokenValueHere</set>
        </condition>
      </change>
   </input>  
  </fieldset>
  <row>
    <panel>
      <html>
        <div>accountid: $accountid$</div>
        <div>BUName: $BUName$</div>
      </html>
    </panel>
  </row>
</dashboard>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

a238574 · ‎03-05-2018

I am trying to overwrite the value of accountid if BUName is "NOT" set to all. I don't quite undetstand why in the condition statemment you used "label" to check for the value of "All"

niketn · ‎03-05-2018

@a238574, I have reversed the logic to override the token when All is not selected in the dropdown.

A dropdown input in Splunk has two tokens associated with is i.e.
1) label - the value displayed to the user
2) value - actual value for selected label to be used in Splunk dashboard.

In this particular case either label or value can be used since both are set to All. I have changed from label to value if you are more comfortable with value.

   <choice value="All">All</choice>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

nabeel652 · ‎05-23-2019

@niketnilay Your submit button is not working. Any reasons why?

How to modify a token based on the value of another token?

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

Splunk APM: New Product Features + Community Office Hours Recap!

Index This | Forward, I’m heavy; backward, I’m not. What am I?