CODEWITHSUNDEEP
splunksplunk-query
DoubleRainbowZ
DoubleRainbowZ

Reputation: 132

Can you map values of a token to another value?

I was wondering if it was possible if you could change the value of a token (dropdown menu) in a query.

For context: I have a dropdown menu - which has values 1,2,3. I am using these values in a search query. However, I am also using another search query with a different index on the same dashboard that uses a,b,c. Is there a way to map the values 1,2,3 -> a,b,c or do it within the search query using an eval or something?

Thanks

Upvotes: 0

Views: 1721

Answers (2)

Simon Duff
Simon Duff

Reputation: 2651

You can set multiple tokens when you select an item from a dropdown. Here is one way of doing it, I'm sure there are others. You would use token1 in your first search, and token2 in the second.

<input type="dropdown" token="token1">
  <label>Select an option</label>
  <default>1</default>
  <choice value="1">1</choice>
  <choice value="2">2</choice>
  <choice value="3">3</choice>
  <change>
    <condition label="1">
      <set token="token2">a</set>
    </condition>
    <condition label="2">
      <set token="token2">b</set>
    </condition>
    <condition label="3">
      <set token="token2">c</set>
    </condition>
  </change>
</input>

Upvotes: 1

warren
warren

Reputation: 33453

If I understand you correctly, you're wanting to use the same base search to populate several dropdowns - is this correct?

What I do on dashboards when I want to do something like this is in the XML, put a search like the following:

<search id="dropdownbase">
    <query>index=ndx sourcetype=srctp fieldA=something fieldB=somethingelse earliest=-24h latest=now
    | stats count by fieldA fieldB
</search>

Then, in the search for the dropdown (ie the dynamic portion), add/modify the following:

<search base="dropdownbase"></search>

And then set your field for value vs field for label to fieldA or fieldB as appropriate

Upvotes: 0

Related Questions