Dashboards & Visualizations

Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments

Path Finder

I am having trouble supporting both URL link parameters for a form input/token and "derived" value tokens which are computed from the value of a form token. As an example, imagine that I have two tokens, tok and derived. The token derived is set when token tok is changed, as follows...

      <input token=“tok”>
        <label>Summary Interval</label>
        <choice value="10minute">10 minutes</choice>
        <choice value="1hour">1 hour</choice>
        <choice value="1day">1 day</choice>
        <default>1hour</default>
        <change>
          <condition value="10minute">
            <eval token="derived">minspan=10m</eval>
          </condition>
          <condition>
            <set token="derived"></set>
          </condition>
        </change>
      </input>

The problem comes when a user links to this dashboard setting tok to "10minute" in the URL (with something like "tok=10minute" in the args). In this case, it seems that the token derived will not be set at all, causing any dependent dashboard panels to wait on token input.

I can work around by computing derived in a search instead, but it sure is convenient to simply set such a related (derived) token right here in the token it depends on. Does this usage of a change clause in the input pretty much ensure that bookmarks and other URL links containing token tok will be a problem?

0 Karma

SplunkTrust
SplunkTrust

@kulick do you have searchWhenChanged for input set to true and submitButton turned false?

Also instead of <eval> use <set> to set the derived token in your dashboard

<set token="derived">minspan=10m</set>

PS: I tried the following code and it worked fine.

Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set

<dashboard>
  <label>Source dashboard with time span</label>
  <row>
    <panel>
      <html>
        <a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
      </html>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard with span input</label>
  <fieldset submitButton="false">
    <input type="dropdown" searchWhenChanged="true" token="tokSummary">
      <label>Summary Interval</label>
      <choice value="10minute">10 minutes</choice>
      <choice value="1hour">1 hour</choice>
      <choice value="1day">1 day</choice>
      <default>1hour</default>
      <change>
        <condition value="10minute">
          <set token="derived">minspan=10m</set>
        </condition>
        <condition>
          <set token="derived"> </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval inputToken="$tokSummary$",derived="$derived$"</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Ultra Champion

Settokensonpageload

set <init>, how about this?

0 Karma