Dashboards & Visualizations

How to pass a dropdown token value to a query and pass the token label to a panel title?

jsoderling
New Member

I want to pass a dropdown token value to a query and pass the token label to a panel title. Using to pull the label changes the value of the token in my query.

form>
  Accounts Audit   

    <panel>
      <input type="time" token="Enable_Acct_tok" searchWhenChanged="true">
        <label>Time Frame</label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
      </input>
      <input type="dropdown" token="event_code_tok" searchWhenChanged="true">
        <label>Event</label>
        <choice value="4720">Created</choice>
        <choice value="4725">Deleted</choice>
        <choice value="4726">Disabled</choice>
        <choice value="4722">Enabled</choice>
        <choice value="4738">Modified</choice>
        <initialValue>4720</initialValue>
        <default>4720</default>
      </input>
      <single>
        <title>$event_code_tok$ Accounts Total</title>
        <search>
          <query>index="con_wineventlog_security" sourcetype="WinEventLog:Security" EventCode=$event_code_tok$  stats dc("Account_Name")</query>
          <earliest>$Enable_Acct_tok.earliest$</earliest>
          <latest>$Enable_Acct_tok.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <refresh>60m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

<input type="dropdown" token="event_code_tok" searchWhenChanged="true">
        <label>Event</label>
        <choice value="4720">Created</choice>
        <choice value="4725">Deleted</choice>
        <choice value="4726">Disabled</choice>
        <choice value="4722">Enabled</choice>
        <choice value="4738">Modified</choice>
        <initialValue>4720</initialValue>
        <default>4720</default>
        <change>
          <condition>
            <set token="panellabel">$label$</set>
          </condition>
        </change>
      </input>
      <single>
        <title>$panellabel$ Accounts Total</title>
        <search>
..
..
..

View solution in original post

vnravikumar
Champion

Hi

Try this

<input type="dropdown" token="event_code_tok" searchWhenChanged="true">
        <label>Event</label>
        <choice value="4720">Created</choice>
        <choice value="4725">Deleted</choice>
        <choice value="4726">Disabled</choice>
        <choice value="4722">Enabled</choice>
        <choice value="4738">Modified</choice>
        <initialValue>4720</initialValue>
        <default>4720</default>
        <change>
          <condition>
            <set token="panellabel">$label$</set>
          </condition>
        </change>
      </input>
      <single>
        <title>$panellabel$ Accounts Total</title>
        <search>
..
..
..

vnravikumar
Champion

@jsoderling, whether it resolved?

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...