Can you set a token to be the value of a built in ...

arhea · ‎07-03-2024

I have a panel (A) that uses a token (usr.name) for input. The token is set by another panel (B) when the user clicks on a user name. In its current state the viewer gets no results in panel A when the dashboard loads and only displays results when the viewer clicks on a username from panel B. I am attempting to initialize the dashboard with a set of default results based on the currently logged in user. If I pull up the dashboard I would like the results in panel A to default to my username. The problem I am running into is that when I set the initial value it accepts it as plain text instead of the token value.

<init>
  <set token="usr.name">$env:user$</set>
</init>
<row>
  <html>
    $usr.name$
  </html>
</row>

This code displays the $usr.name$ token as "$env:user$" instead of my username. My eventual goal is to have panel A display results for myself when I first access the dashboard and for another user if I click on their name in the results of panel B. I have been coming up empty on google so am reaching out here to see if anyone has any ideas.

ITWhisperer · ‎07-03-2024

$env.user$ is only available when a search executes, so try something like this

  <search>
    <query>
| makeresults
| eval user=$env:user|s$
    </query>
    <done>
      <eval token="userid">$result.user$</eval>
    </done>
  </search>

arhea · ‎07-05-2024

Where about in the dashboard source code would this go? I have attempted to add it at the top after "<description>Test</description>" but it doesn't seem to have any affect.

ITWhisperer · ‎07-08-2024

Try like this

<form version="1.1" theme="light">
  <fieldset submitButton="false">
    <input type="text" token="user" depends="$alwayshidden$">
      <label>User</label>
      <default>$env:user$</default>
    </input>
  </fieldset>
  <row>
    <html>
      $user$
    </html>
  </row>
</form>

Can you set a token to be the value of a built in token?

Classic dashboard

token

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?