Splunk Enterprise

How can I update the <valuePrefix> value in a multiselect or checkbox when the related token value is updated?

twidler
Explorer

Hello everyone. I have a Dropdown token being used as the <valuePrefix> in a Multiselect input. The Multiselect seems to only set the <valuePrefix> tag's value during dashboard initialization. I can get a change in the dropdown to take effect on the Multiselect when refreshing the page in the web browser, but not when changing the Dropdown value or when refreshing the panel. This same behaviour applies to the Checkbox input. 

Here is my code for the panel in question: 

    <panel depends="$Global_Tok$">
      <title>CPU</title>
      <input type="multiselect" token="CPU_Field_Global_Multi">
        <label>Fields</label>
        <choice value="(pctUser) AS User">User</choice>
        <choice value="(pctIdle) AS Idle">Idle</choice>
        <choice value="(Load) AS &quot;Load (-Idle)&quot;">Load</choice>
        <choice value="(pctIowait) AS IO_Wait">IO_Wait</choice>
        <choice value="(pctNice) AS Nice">Nice</choice>
        <choice value="(pctSystem) AS System">System</choice>
        <default>"(Load) AS ""Load (-Idle)""",(pctUser) AS User,(pctIdle) AS Idle,(pctIowait) AS IO_Wait,(pctNice) AS Nice,(pctSystem) AS System</default>
        <initialValue>(Load) AS "Load (-Idle)",(pctUser) AS User,(pctIdle) AS Idle,(pctIowait) AS IO_Wait,(pctNice) AS Nice,(pctSystem) AS System</initialValue>
        <valuePrefix>$Global_Function$</valuePrefix>
        <delimiter> </delimiter>
      </input>
      <input type="checkbox" token="CPU_Fields_Cbx">
        <label>Fields</label>
        <choice value="(pctUser) AS User">User</choice>
        <choice value="(pctIdle) AS Idle">Idle</choice>
        <choice value="(Load) AS &quot;Load (-Idle)&quot;">Load</choice>
        <choice value="(pctIowait) AS IO_Wait">IO_Wait</choice>
        <choice value="(pctNice) AS Nice">Nice</choice>
        <choice value="(pctSystem) AS System">System</choice>
        <valuePrefix>$Global_Function$</valuePrefix>
      </input>
      <chart>
        <search>
          <query>host=$HOST_SELECTION$ source=cpu
| multikv
| search CPU=$CPU_Core_Global_Tok$
| eval Load=(pctIdle-100)*-1
| timechart span=$Global_Span$ $CPU_Fields_Cbx$</query>
          <earliest>$Global_Time.earliest$</earliest>
          <latest>$Global_Time.latest$</latest>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="charting.axisTitleX.text">Time</option>
        <option name="charting.axisTitleY.text">CPU Util (%)</option>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>

In this example code, the panel is only using the Checkbox input token for the search, but the same issue is applied when I use the Multiselect as well. The token I am updating with the Dropdown input is "$Global_Function$". 

The code for the Global Function dropdown input is as follows:

<input type="dropdown" token="Global_Function" depends="$Global_Tok$">
      <label>Function</label>
      <choice value="avg">Average</choice>
      <choice value="max">Maximum</choice>
      <default>avg</default>
      <initialValue>avg</initialValue>
    </input>

I have not been able to get the Multiselect or Checkbox inputs to change their initial <valuePrefix> value upon the Function Dropdown changing. So if anyone has suggestions on how to accomplish this, then I am all ears.

Labels (2)
0 Karma

twidler
Explorer

Unfortunately a week later, I have still not been able to find a solution to this issue. So if anyone has a suggestion on how to do this whether via Javascript or otherwise I am open to ideas.

0 Karma

twidler
Explorer

I still have not found a solution to this unfortunately and I don't have a whole lot of time to get this working. So if anyone has a suggestion, I am all for it.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...