topic Re: How to reference a dashboard token in an HTML panel? in Dashboards & Visualizations

How to reference a dashboard token in an HTML panel?

ScottSusman — Mon, 17 Oct 2016 21:03:27 GMT

I regularly get requests for some data that I get from several searches. The people requesting it like it formatted just so, so instead of manually formatting it each time I'd like to have my searches in a dashboard with all the needed data being sent to an html panel so I can format it correctly.

Can someone please help direct me to what I'm doing wrong? I've tried changing the table to a single value and tried various ways to set the token.

Run anywhere:

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| metadata type=hosts | head 1</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
          <condition match="'job.isDone'">
            <set token="MyHost">$results.host$</set>
          </condition>
        </search>
      </table>
    </panel>
    <panel>
      <html>
        <p>Host: $MyHost$</p>
      </html>
    </panel>
  </row>
</dashboard>

I get back:

firstTime   host         lastTime     recentTime   totalCount   type
1476644722   myHostName   1476736882   1476736882   154103       hosts

and Host: $MyHost$ instead of Host: myHostName

Thank you!

Re: How to reference a dashboard token in an HTML panel?

somesoni2 — Mon, 17 Oct 2016 21:25:37 GMT

Try like this (run anywhere sample)

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | head 1 | table host sourcetype source</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
          <done><set token="MyHost">$result.host$</set></done>
        </search>
      </table>
    </panel>
    <panel depends="$MyHost$">
      <html>
         <p>Host: $MyHost$</p>
       </html>
    </panel>
  </row>
</dashboard>

Re: How to reference a dashboard token in an HTML panel?

ScottSusman — Mon, 17 Oct 2016 23:41:26 GMT

Hm... same result on Splunk at work. Works perfect at home.

Re: How to reference a dashboard token in an HTML panel?

somesoni2 — Tue, 18 Oct 2016 03:18:22 GMT

Check the token value is $result.host$ and not $results.host$ .

Re: How to reference a dashboard token in an HTML panel?

ScottSusman — Tue, 18 Oct 2016 12:48:07 GMT

Yep, I'm using result now, not results. I copy/pasted your example (I don't have access to _internal so I changed it to index=*).

At work we have version 6.4.0 and at home I have 6.5.0 (both Enterprise) but I wouldn't think that would matter with something this basic.

Re: How to reference a dashboard token in an HTML panel?

afishkin_splunk — Tue, 18 Oct 2016 17:02:43 GMT

Element <condition> is child of one of Search Handler, such as
<done | error | fail | cancelled | progress>
Please move <condition> under <progress>

Re: How to reference a dashboard token in an HTML panel?

ScottSusman — Tue, 18 Oct 2016 17:21:16 GMT

That's pretty similar to somesoni2's suggestion to use instead of

Using <progress><condition> I now get Host: $result.host$.

         <search>
           <query>| metadata type=hosts | head 1</query>
           <earliest>-60m</earliest>
           <latest>now</latest>
           <progress>
             <condition match="'job.isDone'">
               <set token="MyHost">$result.host$</set>
             </condition>
           </progress>
         </search>

Re: How to reference a dashboard token in an HTML panel?

cmerriman — Tue, 18 Oct 2016 18:51:03 GMT

try setting the job.isDone equal to 1, so that it has to be true to set the token?

  <search>
    <query>...</query>
    <done>
      <condition match="'job.isDone'"=1>
      <set token="host">$result.host$</set>
     </condition>
    </done>
  </search>
</panel>


<html>
      $host$
      </html>

Re: How to reference a dashboard token in an HTML panel?

ScottSusman — Tue, 18 Oct 2016 19:04:11 GMT

<condition match="'job.isDone'"=1> was a syntax error, but when I changed it to <condition match="'job.isDone'=1"> (with the =1 inside the quotes) it stayed as $MyHost$.

Re: How to reference a dashboard token in an HTML panel?

ScottSusman — Tue, 18 Oct 2016 19:04:19 GMT

Not sure if it's relevant, but I can see the value switch from $MyHost$ to $result.host$.

Re: How to reference a dashboard token in an HTML panel?

cmerriman — Tue, 18 Oct 2016 19:16:55 GMT

  <row>
    <panel>
      <table>
        <search>
          <query>| metadata type=hosts | head 1</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
          <preview>
       <set token="host">$result.host$</set>
     </preview>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <html>
       $host|h$
       </html>
  </row>

Re: How to reference a dashboard token in an HTML panel?

ScottSusman — Tue, 18 Oct 2016 19:27:11 GMT

It works! You rock!

Re: How to reference a dashboard token in an HTML panel?

ScottSusman — Tue, 18 Oct 2016 19:33:38 GMT

It looks like between 6.4.0 and 6.5.0 there were some changes to the search options in the Simple XML. Apparently it's important to be looking at docs for the correct version.

<done>  text        Execute actions based on finished search events.
<preview>   text        Preview of search results. Includes job properties and first result row.

Thank you so much!

Re: How to reference a dashboard token in an HTML panel?

gvnd — Fri, 16 Jun 2017 15:01:58 GMT

Thanks, This is what exactly which I was searching for last 5 days..

Re: How to reference a dashboard token in an HTML panel?

bullet — Mon, 30 Jan 2023 08:01:04 GMT

Even I had error and I had to drop the =1 for the error to go away.