topic Re: Handling splunk dashboard token in Dashboards & Visualizations

Handling splunk dashboard token

kranthimutyala — Wed, 23 Oct 2019 12:03:17 GMT

Hi All,

I have a dashboard which contains 2 inputs(both are text fields ).But the user can give the values in both the text fields or he can give only in one of the text fields leaving the other one blank(but the query in the panel doesn't work if any of the token is null)

So when he gives the input in first field the second should be * and vice versa.
But i do want to show the * in the text box by setting up it in the default value

Or how can i ignore the second token(assuming nothing is provided) in the panel search query so that it can generate the results based on one token

Sample query in the panel : index=abc event=$token1$ agent=$token2$ | table action object

Can someone help me on how to handle this situation.

Thank you in advance

Re: Handling splunk dashboard token

tomawest — Wed, 23 Oct 2019 12:28:55 GMT

Set the default value for both text fields to *.
Your issue is that the token is unset when nothing is entered in.

Re: Handling splunk dashboard token

gaurav_maniar — Wed, 23 Oct 2019 13:51:33 GMT

Hi,

below code will resolve your issue,

<input type="text" token="tok2">
    <label>field2</label>
    <default>*</default>
</input>

Accept and upvote the answer if it helps.

happy splunking........!!!!

Re: Handling splunk dashboard token

kranthimutyala — Wed, 23 Oct 2019 14:49:10 GMT

This will show (*) as default values but i want to hide it in the back bot showing up to the user

Re: Handling splunk dashboard token

Anantha123 — Wed, 23 Oct 2019 15:24:28 GMT

Hi , Try below . Give space in default.

  <label>field1</label>
  <default></default>
</input>

Re: Handling splunk dashboard token

kranthimutyala — Thu, 24 Oct 2019 04:12:38 GMT

thats not working

Re: Handling splunk dashboard token

kranthimutyala — Thu, 24 Oct 2019 04:13:33 GMT

Please find the below code.In the below code whenever user doesn't specify any value for either source/log_level it must be replaced with *.
But i don't want to use * in default value as user doesn't want to see that.So need your help in handling this token whenever it is null change it to * internally using eval.Thank you

input_test

<input type="text" token="src">
  <label>specify source</label>
</input>
<input type="text" token="log">
  <label>log_level</label>
</input>
<input type="time" token="field1">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <table>
    <search>
      <query>index=_internal sourcetype=$src$ log_level=$log$|table sourcetype log_level</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table>
</panel>

Re: Handling splunk dashboard token

gaurav_maniar — Thu, 24 Oct 2019 08:51:13 GMT

Hi,

If your are fine with using javascript, below code will work,

<form script="default_token.js">
  <label>Default Token</label>
  <fieldset submitButton="true">
    <input type="text" token="token1">
      <label>Field</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Default Token</title>
      <table>
        <search>
          <query>index=_internal sourcetype=$token1$ | head 1 | table _time, _raw</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

default_token.js
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView, SearchManager) {

    var tokens = mvc.Components.get("default");

    $(document).on("click", "#submit", function(e){
        var tok1 = tokens.get("token1");

        if (tok1 == undefined || tok1 == ""){
            tokens.set("token1", "*");
        }
    });
});

Re: Handling splunk dashboard token

kranthimutyala — Fri, 25 Oct 2019 09:54:59 GMT

require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView, SearchManager) {

 var tokens = mvc.Components.get("default");

 $(document).on("click", "#submit", function(e){
     var tok1 = tokens.get("token1");

     if (tok1 == undefined || tok1 == ""){
         tokens.set("token1", "*");
     }
 });

 $(document).on("click", "#submit", function(e){
     var tok2 = tokens.get("token1");

     if (tok2 == undefined || tok2 == ""){
         tokens.set("token2", "*");
     }
 });

});

this code is not working , i want to implement this for two tokens

Re: Handling splunk dashboard token

kranthimutyala — Fri, 25 Oct 2019 09:56:20 GMT

$(document).on("click", "#submit", function(e){
var tok2 = tokens.get("token2");

     if (tok2 == undefined || tok2 == ""){
         tokens.set("token2", "*");

I have added this snippet for token2, but its not working .Can you please help me with the script for more than one token change

Re: Handling splunk dashboard token

kranthimutyala — Fri, 25 Oct 2019 11:28:15 GMT

@gaurav_maniar Thanks for your answer, its working well.Thank you very much