Dashboards & Visualizations

Dashboard dynamic search string in a panel

vikashumble
Explorer

Hello, 

I have a dashboard with couple of pie charts and a summary table. First Pie chart sets token 1, second token 2 and so on. I was wondering if there is any way in which I can refresh the summary table with the token values selected?

In other words, if token 1 is set but token 2 is unset, then

BASE SEARCH | search token1=$token1$, token2=* (since token 2 is not set yet)

If token 1 and token 2 is set, then 

BASE SEARCH | search token1=$token1$, token2=$token2$ (as both tokens are set.

Eventually what I am trying to do is keep refreshing the dashboard based on user clicks, but if at the moment, unless user sets the token1 and token2, my dashboard panel is not showing anything. It is stuck at "waiting for user input".  

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can create and init block at the top of the dashboard source to set your token on dashboard load

<init>
  <set token="token1">*</set>
  <set token="token2">*</set>
</init>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can create and init block at the top of the dashboard source to set your token on dashboard load

<init>
  <set token="token1">*</set>
  <set token="token2">*</set>
</init>
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...