Dashboards & Visualizations

Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments

kulick
Path Finder

I am having trouble supporting both URL link parameters for a form input/token and "derived" value tokens which are computed from the value of a form token. As an example, imagine that I have two tokens, tok and derived. The token derived is set when token tok is changed, as follows...

      <input token=“tok”>
        <label>Summary Interval</label>
        <choice value="10minute">10 minutes</choice>
        <choice value="1hour">1 hour</choice>
        <choice value="1day">1 day</choice>
        <default>1hour</default>
        <change>
          <condition value="10minute">
            <eval token="derived">minspan=10m</eval>
          </condition>
          <condition>
            <set token="derived"></set>
          </condition>
        </change>
      </input>

The problem comes when a user links to this dashboard setting tok to "10minute" in the URL (with something like "tok=10minute" in the args). In this case, it seems that the token derived will not be set at all, causing any dependent dashboard panels to wait on token input.

I can work around by computing derived in a search instead, but it sure is convenient to simply set such a related (derived) token right here in the token it depends on. Does this usage of a change clause in the input pretty much ensure that bookmarks and other URL links containing token tok will be a problem?

0 Karma
1 Solution

@kulick do you have searchWhenChanged for input set to true and submitButton turned false?

Also instead of <eval> use <set> to set the derived token in your dashboard

<set token="derived">minspan=10m</set>

PS: I tried the following code and it worked fine.

Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set

<dashboard>
  <label>Source dashboard with time span</label>
  <row>
    <panel>
      <html>
        <a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
      </html>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard with span input</label>
  <fieldset submitButton="false">
    <input type="dropdown" searchWhenChanged="true" token="tokSummary">
      <label>Summary Interval</label>
      <choice value="10minute">10 minutes</choice>
      <choice value="1hour">1 hour</choice>
      <choice value="1day">1 day</choice>
      <default>1hour</default>
      <change>
        <condition value="10minute">
          <set token="derived">minspan=10m</set>
        </condition>
        <condition>
          <set token="derived"> </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval inputToken="$tokSummary$",derived="$derived$"</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

@kulick do you have searchWhenChanged for input set to true and submitButton turned false?

Also instead of <eval> use <set> to set the derived token in your dashboard

<set token="derived">minspan=10m</set>

PS: I tried the following code and it worked fine.

Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set

<dashboard>
  <label>Source dashboard with time span</label>
  <row>
    <panel>
      <html>
        <a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
      </html>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard with span input</label>
  <fieldset submitButton="false">
    <input type="dropdown" searchWhenChanged="true" token="tokSummary">
      <label>Summary Interval</label>
      <choice value="10minute">10 minutes</choice>
      <choice value="1hour">1 hour</choice>
      <choice value="1day">1 day</choice>
      <default>1hour</default>
      <change>
        <condition value="10minute">
          <set token="derived">minspan=10m</set>
        </condition>
        <condition>
          <set token="derived"> </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval inputToken="$tokSummary$",derived="$derived$"</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

kulick
Path Finder

Sorry for the slow reply and thanks for the code review.  Definitely misused eval there in my example.  I will use searchWhenChanged="true" in the future.  Thanks!

 

0 Karma

to4kawa
Ultra Champion

Set_tokens_on_page_load

set <init>, how about this?

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...