topic Re: Eval token to be used inside panel in Splunk Search

Eval token to be used inside panel

pedropiin — Fri, 11 Jul 2025 15:06:57 GMT

Hi everyone.

I have a panel that contains a list of links to other dashboards. I need to create a new list item with a link that changes dinamically according to the values of three tokens evaluated inside "eval" blocks. But, as splunk makes it clear, I can't create "eval" blocks inside of a panel. So I wanted to know if there's a way to evaluate these tokens such that they can be used within the scope of the "panel" block.

Thanks in advance,
Pedro

Re: Eval token to be used inside panel

livehybrid — Fri, 11 Jul 2025 15:20:39 GMT

Hi @pedropiin

Is this as a classic XML dashboard or in Dashboard Studio?
Are you able to share what you currently have?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Eval token to be used inside panel

livehybrid — Fri, 11 Jul 2025 15:26:16 GMT

Hi @pedropiin

You could create a field returned by the SPL of your search which has an _ (underscore) prefix, this wont be rendered in the visualisation but can be used in the drilldown.

e.g.

| eval _link="https://".$domain$."/".$path$

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Eval token to be used inside panel

pedropiin — Fri, 11 Jul 2025 15:26:29 GMT

Hi @livehybrid. Its a classic XML dashboard. I'm "coding" it without using Dashboard Studio.

My dashboard is pretty big, so I'm afraid I can't share my code. But this panel with the list is one of the first elements of the dashboard.

Thanks,
Pedro

Re: Eval token to be used inside panel

pedropiin — Fri, 11 Jul 2025 15:30:15 GMT

Hi @livehybrid

I dont have a drilldown. Its simply a panel of the format:

Re: Eval token to be used inside panel

bowesmana — Sun, 13 Jul 2025 23:28:19 GMT

I don't know what you mean when you say you can't create eval blocks inside a panel, you can do pretty much whatever you like inside a panel, e.g. you can do this

<panel id="panel1"> <title>My Panel</title> <html> <style> ... </style> </html> <html> <li><a href="..." target="..."><b>Link1</b></a></li> <li><a href="..." target="..."><b>Link2</b></a></li> <li><a href="..." target="..."><b>Link3</b></a></li> <li><a href="..." target="..."><b>$Link4$</b></a></li> </html> <table depends="$hidden_table$"> <search> <query> | makeresults | eval Link4=https://$token_1$/".$token_2$."/".$token_3" </query> <done> <set token="Link4">$result.Link4$</set> </done> </search> </table> </panel>

so you have a hidden table inside the panel that performs any search you want and creates any kind of value you need, then the done clause creates the new Link4 token from your result and that $Link4$ token is then used in the <html> section of the panel.

Re: Eval token to be used inside panel

yuanliu — Mon, 14 Jul 2025 03:32:50 GMT

You can use a hidden table like @bowesmana suggests. Or you can use a bare <search/> element without panel, like this:

<form version="1.1"> <label>https://community.splunk.com/t5/forums/replypage/board-id/splunk-search/message-id/242210</label> <search> <query> | makeresults | eval Link4=https://$token_1$/".$token_2$."/".$token_3" </query> <done> <set token="Link4">$result.Link4$</set> </done> </search> ... <row> <panel id="panel1"> <title>My Panel</title> <html> <style> ... </style> </html> <html> <li><a href="..." target="..."><b>Link1</b></a></li> <li><a href="..." target="..."><b>Link2</b></a></li> <li><a href="..." target="..."><b>Link3</b></a></li> <li><a href="$Link4$" target="..."><b>$Link4</b></a></li> </html> </panel> </row> </form>

Re: Eval token to be used inside panel

PrewinThomas — Mon, 14 Jul 2025 04:08:14 GMT

@pedropiin
Make a hidden search and set your tokens.
And use the token inside your panel.

<row depends="$alwaysHide$"> <panel> <search id="token_generator"> <query> | makeresults | eval tokenA="value1", tokenB="value2", tokenC="value3" | eval dynamic_link="/app/search/dashboard_name?fieldA=".tokenA."&fieldB=".tokenB."&fieldC=".tokenC </query> <done> <set token="myDynamicLink">$result.dynamic_link$</set> </done> </search> </panel> </row> <panel> <html> <ul> <li><a href="$myDynamicLink$">Dynamic Dashboard</a></li> </ul> </html> </panel>

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Eval token to be used inside panel

livehybrid — Mon, 14 Jul 2025 08:21:58 GMT

Hi @pedropiin

Where do the values currently come from that you want to use within your eval?