topic Re: How to convert splunk dashboard panel with dynamic token in reports? in Splunk Search

How to convert splunk dashboard panel with dynamic token in reports?

karthi2809 — Tue, 28 May 2024 09:59:56 GMT

Hi All,

I have a Splunk dashboard with dynamic token, Here a simplified example of my setup. In the dashboard $new_value$ and $env$ are dynamic token that user can select. I want to convert this panel into report that can accommodate these dynamic values. Could you guide me how to achieve this ?.I need to understand. Any details steps or examples would be greatly appreciated.

Base Query: index=Test environment=$env$ applicationName=$new_value$ | stats values(content.InterfaceName) as InterfaceName values(content.payload) as payloadFile values(content.ErrorMsg) as errormsg values(content.Error) as error BY applicationName,correlationId | table Status Timestamp InterfaceName ApplicationName CorrelationId | search interfaceName=$new_interface$ Panel Query with dynamic tokens: <search base="BankSearch"> <query>| where Status LIKE ("$countStatus$")|sort -Timestamp</query></search>

Re: How to convert splunk dashboard panel with dynamic token in reports?

gcusello — Tue, 28 May 2024 10:20:08 GMT

Hi @karthi2809,

for my knowledge, reports are static objects and you cannot pass a token to a report.

Why do you want to do this?

if it's to accelerate searches, use other methods as Data_nodels or Summary indexes.

Ciao.

giuseppe

Re: How to convert splunk dashboard panel with dynamic token in reports?

karthi2809 — Tue, 28 May 2024 10:32:42 GMT

Hi @gcusello

Thanks for the reply. Actually i want to improve my dashboard performance. So i try to convert as report. But as you said its static. So if i use summary index or data model we can pass token ?any sample data model .And both will consume license right?

Re: How to convert splunk dashboard panel with dynamic token in reports?

gcusello — Tue, 28 May 2024 10:37:24 GMT

Hi @karthi2809,

Yes, you can pass a token to a search based on DataModels or Summary Indexes.

Both of them don't consume license.

Ciao.

Giuseppe