Splunk Search

How to replace the value of a field by a token value in an xml form?

stephane_cyrill
Builder

Hi everyone,

I have a field call status, and I have a drop-down with values: open, new, in progress.......

What i need is:

1) When the user chooses a value from the drop-down, the status on the dashboard changes to that value

2) Is it possible to keep track of the changing of the status? How?

This is what I've tried:

<form>
  <label>CHANGE STATUS</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="status_token" searchWhenChanged="true">
      <label>Change status</label>
      <choice value="new">new</choice>
      <default>new</default>
      <choice value="Open">Open</choice>
      <choice value="Closed">Closed</choice>
      <choice value="progress">in progress</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title> </title>
      <table>
        <title>status is $status_token$</title>
        <search>
          <query>index=_* |eval status="change this status"|eval status=if($status_token$!="change this status",$status_token$ ,"change this status")| table host source status</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>
Tags (4)
1 Solution

Raghav2384
Motivator

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Not sure if i understand your question, if you want the search to include user selection, since you have status as a token

How about adding status="$status_token$" to your search?

Example let's say user selected status = in progress from the drop-down.
index=_* status="$status_token$"|...... would read
index=_* status="in progress"|....

Hope this helps.
Thanks,
Raghav

stephane_cyrill
Builder

THanks Raghav2384

very much I try the quote on the token an it is working: status="$status_token$"

Raghav2384
Motivator

Please feel free to accept it as an answer 🙂

stephane_cyrill
Builder

I"m not seeing the link to accept but I voted.

0 Karma

Raghav2384
Motivator

there you go 🙂

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...