topic Re: Generate Token without Panel in Splunk ITSI

Generate Token without Panel

logankinman99 — Fri, 08 Nov 2019 14:23:50 GMT

I'm working on making an interactive dashboard, and I'm not sure how to do something...

My dashboard shows a pie chart of the top servers where errors are occurring. Next to it, a statistics table shows from what file source the top errors are coming from.
What I'm trying to figure out is how I would be able to click on a file source in the statistics table, and then change the pie chart to show only the servers that have errors matching with that clicked source.

Currently, I have it set up as errorSource=* for my pie chart, but that doesn't allow for token change. It would make sense to me to initialize something like $errorSourceToken=*$, but I don't know how I would initialize that without some kind of input like a radio button select or something (which I don't want to appear).

Let me know if you know of any solutions. Thanks so much!
-Logan

Re: Generate Token without Panel

vik_splunk — Fri, 08 Nov 2019 14:38:47 GMT

@logankinman99 that can certainly be down using the contextual drilldown approach

You will have to set a token based on the clicked value. Examples below

Hope that helps.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/ContextualDrilldown

https://answers.splunk.com/answers/405291/how-to-change-the-search-based-on-a-clicked-table.html

Re: Generate Token without Panel

logankinman99 — Fri, 08 Nov 2019 15:10:35 GMT

Well, I quickly found a solution to my own question. For anyone else who may have this problem...

It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.

< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>
< /form>

After setting that in the XML, I was able to edit the drilldown through the UI

Re: Generate Token without Panel

woodcock — Fri, 08 Nov 2019 15:17:34 GMT

To generate a token without a panel, you can use a base_search and then an eval token in the change section. Also, you can just hard-code non-search-results based tokens at the top of your XML like this:

  <init>
    <!-->For some reason, in drilldown URLs, $APP$, just DOES NOT WORK!<-->
    <!-->It ought to be that setting 'env_app' to a value of '$APP$' works, but it does NOT!<-->
    <set token="env_app">MyHardCodedAppNameHere</set>
  </init>