topic Re: declaring a variable in splunk dasboard and make available to all searches in Splunk Search

declaring a variable in splunk dasboard and make available to all searches

HattrickNZ — Thu, 16 Nov 2017 20:12:21 GMT

I have a splunk dashboard with multiple panels/searches. My sample dashboard below.

I want to be able to declare a variable at the top that is available to every search below, on the dashboard.

Can this be done in advanced XML. Appreciate any advise.

My sample dashboard. For example, I am using VaribleX = 500 as the variable to be shared across the dashboard.

<form>
    ...

VaribleX = 500
  <row>
    <panel>
      <title>device=BRT01KPR component="GigabitEthernet1_0_1.200" Mbps</title>
      <table>
        <search>
          <query>
          search 1 ... | timechart span=d sum(VariableX)
          </query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        ...
      </table>
    </panel>
    <panel>
      <title>device=BRT01KPR component="GigabitEthernet1_0_1.200" Mbps</title>
      <table>
        <search>
          <query>
          search 1 ... | timechart span=d sum(VariableX)
          </query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        ...
      </table>
    </panel>
</row>

...

  <row>
    <panel>
      <title>device=BRT01KPR component="GigabitEthernet1_0_1.200" Mbps</title>
      <table>
        <search>
          <query>
          search 1 ... | timechart span=d sum(VariableX)
          </query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        ...
      </table>
    </panel>
    <panel>
      <title>device=BRT01KPR component="GigabitEthernet1_0_1.200" Mbps</title>
      <table>
        <search>
          <query>
          search 1 ... | timechart span=d sum(VariableX)
          </query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        ...
      </table>
    </panel>
</row>

</form>

Re: declaring a variable in splunk dasboard and make available to all searches

sgundeti — Thu, 16 Nov 2017 21:07:34 GMT

I believe you want to pass value dynamically..!
You can do this using simple XML and you have started correctly by selecting form. Now you should be able to select input type text from "Add Input" and give label for your variable(My Variable), variable name (VariableX), and default value(500) as optional. Then use your variable in dashboard code as $VariableX$ to replace user input.
your input should look something like shown in screenshot and your search like below.

<query>
           search 1 ... Field=$VariableX$ | .... 
</query>

Re: declaring a variable in splunk dasboard and make available to all searches

maciep — Thu, 16 Nov 2017 21:35:24 GMT

If you don't want users selecting that value via an input, you can just use the init tag to set it on dashboard load. Here's a simple example:

<dashboard>
  <label>Init Token</label>
  <init>
    <set token="variableX">splunkd</set>
  </init>
  <row>
    <panel>
      <table>
        <search>
          <query>|  tstats count where index=_internal sourcetype=$variableX$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: declaring a variable in splunk dasboard and make available to all searches

HattrickNZ — Tue, 28 Nov 2017 01:45:27 GMT

tks both answers are good

Re: declaring a variable in splunk dasboard and make available to all searches

HattrickNZ — Tue, 28 Nov 2017 01:45:33 GMT

tks both answers are good

Re: declaring a variable in splunk dasboard and make available to all searches

HattrickNZ — Tue, 28 Nov 2017 01:50:03 GMT

<form hideFilters="true"> to hide the filters