topic What's the value of a token if is not set in an input? in Splunk Enterprise

What's the value of a token if is not set in an input?

AleCanzo — Thu, 19 Jun 2025 13:34:02 GMT

Hi everyone,
What's the value of a token if is not set in an input? An empty string, null() or?
I was trying to do something like:
| eval user=if(isnull("$user_token$"), user, "$user_token$"), but it doesn't work.

Re: What's the value of a token if is not set in an input?

ITWhisperer — Thu, 19 Jun 2025 13:57:50 GMT

If a token is not set, the dashboard will wait until the token is set before proceeding to evaluate the search.

What is your usecase? Perhaps there may be a better way to approach this?

Re: What's the value of a token if is not set in an input?

richgalloway — Thu, 19 Jun 2025 14:01:30 GMT

An unset token has no value, but it is not null, either. It's as though the token doesn't exist.

Splunk will not execute a query if any of the tokens within it are undefined.

Re: What's the value of a token if is not set in an input?

isoutamo — Thu, 19 Jun 2025 14:28:53 GMT

When you are playing with tokens in SXML, you should install this app https://classic.splunkbase.splunk.com/app/1603/

Then add this into your forms.

After this it shows all tokens what you have and what are their values like

When I add ip, but didn't press submit

After submit is pressed.

https://data-findings.com/wp-content/uploads/2024/09/HSUG-20240903-Tiia-Ojares.pdf

Re: What's the value of a token if is not set in an input?

moorte — Thu, 19 Jun 2025 17:11:58 GMT

The other thing you can do without installing an app is to go into the xml and create an html tag

<row>
<html>
Value of token1 = $token1$
Value of token2 = $otken2$
</html>
</row>

I may have shorthanded the html tags, but basically everytime the token changes the token value will be displayed in that html tag. Really easy way to keep track of the token value. If you need a default token value look into using the <set> function in tokens.

But @ITWhisperer was spot on when he said that when a token is not set it is neither empty nor null.

Re: What's the value of a token if is not set in an input?

isoutamo — Thu, 19 Jun 2025 17:34:14 GMT

No need to use html tags. You could add those into title etc. But when you have lot of those and you will set and unset those based on buttons, clicks etc. then this approach doesn’t work anymore.

Re: What's the value of a token if is not set in an input?

LAME-Creations — Thu, 19 Jun 2025 23:47:12 GMT

No app necessary and doesn't need javascript. Works on a post. This is the way to go. Using an app is not a bad method, but sometimes you have to go through a change control board or you use splunk cloud. Using an HTML Tag will work as long as you have edit rights to the dashboard, which you should if you are coding the dashboard.

Re: What's the value of a token if is not set in an input?

LAME-Creations — Thu, 19 Jun 2025 23:49:39 GMT

The following youtube video shows this tactic

Master Splunk Dashboards: Expert Guide to Troubleshooting Tokens!

it is at about the 7 minute mark of the video.

<row>
<panel>
<html>
your code
</html>
</panel>
</row>

Re: What's the value of a token if is not set in an input?

bowesmana — Fri, 20 Jun 2025 04:01:12 GMT

As @ITWhisperer points out, the token has no value so your search won't run at all to get to that point.

If you want to always have a token so you search will run, you should set the default for the token to something, even if it's just the empty string, i.e. <default></default> but then your SPL would be

| eval user=if(len($user_token|s$)=0, user, $user_token|s$)

i.e. it checks for length of 0 in the input. Note the use of $user_token|s$, i.e. with a |s before the final $ sign which effectively quotes the token.