- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Bad Dashboard Interaction: Form Input Derived Toke...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am having trouble supporting both URL link parameters for a form input/token and "derived" value tokens which are computed from the value of a form token. As an example, imagine that I have two tokens, tok and derived. The token derived is set when token tok is changed, as follows...
<input token=“tok”>
<label>Summary Interval</label>
<choice value="10minute">10 minutes</choice>
<choice value="1hour">1 hour</choice>
<choice value="1day">1 day</choice>
<default>1hour</default>
<change>
<condition value="10minute">
<eval token="derived">minspan=10m</eval>
</condition>
<condition>
<set token="derived"></set>
</condition>
</change>
</input>
The problem comes when a user links to this dashboard setting tok to "10minute" in the URL (with something like "tok=10minute" in the args). In this case, it seems that the token derived will not be set at all, causing any dependent dashboard panels to wait on token input.
I can work around by computing derived in a search instead, but it sure is convenient to simply set such a related (derived) token right here in the token it depends on. Does this usage of a change clause in the input pretty much ensure that bookmarks and other URL links containing token tok will be a problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@kulick do you have searchWhenChanged for input set to true and submitButton turned false?
Also instead of <eval> use <set> to set the derived token in your dashboard
<set token="derived">minspan=10m</set>
PS: I tried the following code and it worked fine.
Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set
<dashboard>
<label>Source dashboard with time span</label>
<row>
<panel>
<html>
<a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
</html>
</panel>
</row>
</dashboard>
Destination Dashboard
<form>
<label>Destination Dashboard with span input</label>
<fieldset submitButton="false">
<input type="dropdown" searchWhenChanged="true" token="tokSummary">
<label>Summary Interval</label>
<choice value="10minute">10 minutes</choice>
<choice value="1hour">1 hour</choice>
<choice value="1day">1 day</choice>
<default>1hour</default>
<change>
<condition value="10minute">
<set token="derived">minspan=10m</set>
</condition>
<condition>
<set token="derived"> </set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| makeresults
| fields - _time
| eval inputToken="$tokSummary$",derived="$derived$"</query>
</search>
</table>
</panel>
</row>
</form>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@kulick do you have searchWhenChanged for input set to true and submitButton turned false?
Also instead of <eval> use <set> to set the derived token in your dashboard
<set token="derived">minspan=10m</set>
PS: I tried the following code and it worked fine.
Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set
<dashboard>
<label>Source dashboard with time span</label>
<row>
<panel>
<html>
<a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
</html>
</panel>
</row>
</dashboard>
Destination Dashboard
<form>
<label>Destination Dashboard with span input</label>
<fieldset submitButton="false">
<input type="dropdown" searchWhenChanged="true" token="tokSummary">
<label>Summary Interval</label>
<choice value="10minute">10 minutes</choice>
<choice value="1hour">1 hour</choice>
<choice value="1day">1 day</choice>
<default>1hour</default>
<change>
<condition value="10minute">
<set token="derived">minspan=10m</set>
</condition>
<condition>
<set token="derived"> </set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| makeresults
| fields - _time
| eval inputToken="$tokSummary$",derived="$derived$"</query>
</search>
</table>
</panel>
</row>
</form>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry for the slow reply and thanks for the code review. Definitely misused eval there in my example. I will use searchWhenChanged="true" in the future. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
set <init>, how about this?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
