Dashboards & Visualizations

Can you set a token to be the value of a built in token?

arhea
Loves-to-Learn Lots

I have a panel (A) that uses a token (usr.name) for input. The token is set by another panel (B) when the user clicks on a user name. In its current state the viewer gets no results in panel A when the dashboard loads and only displays results when the viewer clicks on a username from panel B. I am attempting to initialize the dashboard with a set of default results based on the currently logged in user. If I pull up the dashboard I would like the results in panel A to default to my username. The problem I am running into is that when I set the initial value it accepts it as plain text instead of the token value.

 

<init>
  <set token="usr.name">$env:user$</set>
</init>
<row>
  <html>
    $usr.name$
  </html>
</row>

 

This code displays the $usr.name$ token as "$env:user$" instead of my username. My eventual goal is to have panel A display results for myself when I first access the dashboard and for another user if I click on their name in the results of panel B. I have been coming up empty on google so am reaching out here to see if anyone has any ideas.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

$env.user$ is only available when a search executes, so try something like this

  <search>
    <query>
| makeresults
| eval user=$env:user|s$
    </query>
    <done>
      <eval token="userid">$result.user$</eval>
    </done>
  </search>
0 Karma

arhea
Loves-to-Learn Lots

Where about in the dashboard source code would this go? I have attempted to add it at the top after "<description>Test</description>" but it doesn't seem to have any affect.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

<form version="1.1" theme="light">
  <fieldset submitButton="false">
    <input type="text" token="user" depends="$alwayshidden$">
      <label>User</label>
      <default>$env:user$</default>
    </input>
  </fieldset>
  <row>
    <html>
      $user$
    </html>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...