topic need to replace splunk dashboard tokens to * if they are undefined in Dashboards & Visualizations

need to replace splunk dashboard tokens to * if they are undefined

kranthimutyala — Fri, 25 Oct 2019 09:45:07 GMT

I have two TEXT fields Object and modifier. I want to create dashboard based on either of the field. tried with "if condition", it did not work.
Javascript is also fine

Example:
field1=object
field2=modifier

| index=name event=$object$ action=$modifier$ |table content group

-->if both fields are provided no worries
-->if both are not provided then both should be "wildcard(star)"
-->if field1 is specified and field2 is not specified then field2 should be "wildcard(star)"
-->if field2 is specified and field1 is not specified then field1 should be "*"

How to achieve this?

Note:I dont want to achieve this by using * in default value

Thanks.
Kranthi M

Re: need to replace splunk dashboard tokens to * if they are undefined

harshpatel — Fri, 25 Oct 2019 10:16:44 GMT

Hi @kranthimutyala ,

I think what you can do here is have one more layer of token through javascript. Where changing the filter will cause these next layer of tokens to update which are set by your logic.

For example:

Lets say you have filter token named as $filter_token$ . So what you can do is have onChange event listener on this token and inside that you can check for value of the token and according to that set another token named $search_token$ which will be used in the query. That way you can keep the text input empty and on page load you can initialize $search_token$ to be * which won't show up on the text input that you are displaying.

Hope this helps,
Harsh

Re: need to replace splunk dashboard tokens to * if they are undefined

gaurav_maniar — Fri, 25 Oct 2019 14:05:25 GMT

Hi,

The below answer may solve your issue.

https://answers.splunk.com/answers/777312/handling-splunk-dashboard-token.html