Dashboards & Visualizations

Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments

kulick
Path Finder

I am having trouble supporting both URL link parameters for a form input/token and "derived" value tokens which are computed from the value of a form token. As an example, imagine that I have two tokens, tok and derived. The token derived is set when token tok is changed, as follows...

      <input token=“tok”>
        <label>Summary Interval</label>
        <choice value="10minute">10 minutes</choice>
        <choice value="1hour">1 hour</choice>
        <choice value="1day">1 day</choice>
        <default>1hour</default>
        <change>
          <condition value="10minute">
            <eval token="derived">minspan=10m</eval>
          </condition>
          <condition>
            <set token="derived"></set>
          </condition>
        </change>
      </input>

The problem comes when a user links to this dashboard setting tok to "10minute" in the URL (with something like "tok=10minute" in the args). In this case, it seems that the token derived will not be set at all, causing any dependent dashboard panels to wait on token input.

I can work around by computing derived in a search instead, but it sure is convenient to simply set such a related (derived) token right here in the token it depends on. Does this usage of a change clause in the input pretty much ensure that bookmarks and other URL links containing token tok will be a problem?

0 Karma
1 Solution

niketn
Legend

@kulick do you have searchWhenChanged for input set to true and submitButton turned false?

Also instead of <eval> use <set> to set the derived token in your dashboard

<set token="derived">minspan=10m</set>

PS: I tried the following code and it worked fine.

Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set

<dashboard>
  <label>Source dashboard with time span</label>
  <row>
    <panel>
      <html>
        <a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
      </html>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard with span input</label>
  <fieldset submitButton="false">
    <input type="dropdown" searchWhenChanged="true" token="tokSummary">
      <label>Summary Interval</label>
      <choice value="10minute">10 minutes</choice>
      <choice value="1hour">1 hour</choice>
      <choice value="1day">1 day</choice>
      <default>1hour</default>
      <change>
        <condition value="10minute">
          <set token="derived">minspan=10m</set>
        </condition>
        <condition>
          <set token="derived"> </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval inputToken="$tokSummary$",derived="$derived$"</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@kulick do you have searchWhenChanged for input set to true and submitButton turned false?

Also instead of <eval> use <set> to set the derived token in your dashboard

<set token="derived">minspan=10m</set>

PS: I tried the following code and it worked fine.

Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set

<dashboard>
  <label>Source dashboard with time span</label>
  <row>
    <panel>
      <html>
        <a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
      </html>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard with span input</label>
  <fieldset submitButton="false">
    <input type="dropdown" searchWhenChanged="true" token="tokSummary">
      <label>Summary Interval</label>
      <choice value="10minute">10 minutes</choice>
      <choice value="1hour">1 hour</choice>
      <choice value="1day">1 day</choice>
      <default>1hour</default>
      <change>
        <condition value="10minute">
          <set token="derived">minspan=10m</set>
        </condition>
        <condition>
          <set token="derived"> </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval inputToken="$tokSummary$",derived="$derived$"</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

kulick
Path Finder

Sorry for the slow reply and thanks for the code review.  Definitely misused eval there in my example.  I will use searchWhenChanged="true" in the future.  Thanks!

 

0 Karma

to4kawa
Ultra Champion

Set_tokens_on_page_load

set <init>, how about this?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...