Search code examples
splunksplunk-query

Can you map values of a token to another value?


I was wondering if it was possible if you could change the value of a token (dropdown menu) in a query.

For context: I have a dropdown menu - which has values 1,2,3. I am using these values in a search query. However, I am also using another search query with a different index on the same dashboard that uses a,b,c. Is there a way to map the values 1,2,3 -> a,b,c or do it within the search query using an eval or something?

Thanks


Solution

  • You can set multiple tokens when you select an item from a dropdown. Here is one way of doing it, I'm sure there are others. You would use token1 in your first search, and token2 in the second.

    <input type="dropdown" token="token1">
      <label>Select an option</label>
      <default>1</default>
      <choice value="1">1</choice>
      <choice value="2">2</choice>
      <choice value="3">3</choice>
      <change>
        <condition label="1">
          <set token="token2">a</set>
        </condition>
        <condition label="2">
          <set token="token2">b</set>
        </condition>
        <condition label="3">
          <set token="token2">c</set>
        </condition>
      </change>
    </input>