Dashboards & Visualizations

Dashboard dynamic search string in a panel

vikashumble
Explorer

Hello, 

I have a dashboard with couple of pie charts and a summary table. First Pie chart sets token 1, second token 2 and so on. I was wondering if there is any way in which I can refresh the summary table with the token values selected?

In other words, if token 1 is set but token 2 is unset, then

BASE SEARCH | search token1=$token1$, token2=* (since token 2 is not set yet)

If token 1 and token 2 is set, then 

BASE SEARCH | search token1=$token1$, token2=$token2$ (as both tokens are set.

Eventually what I am trying to do is keep refreshing the dashboard based on user clicks, but if at the moment, unless user sets the token1 and token2, my dashboard panel is not showing anything. It is stuck at "waiting for user input".  

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can create and init block at the top of the dashboard source to set your token on dashboard load

<init>
  <set token="token1">*</set>
  <set token="token2">*</set>
</init>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can create and init block at the top of the dashboard source to set your token on dashboard load

<init>
  <set token="token1">*</set>
  <set token="token2">*</set>
</init>
Get Updates on the Splunk Community!

What's New in Splunk Observability - November 2025

Feature Highlight  Analyze your dimensions and metrics with Usage Analytics  To help optimize telemetry data ...

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...