Dashboards & Visualizations

Dashboard dynamic search string in a panel

vikashumble
Explorer

Hello, 

I have a dashboard with couple of pie charts and a summary table. First Pie chart sets token 1, second token 2 and so on. I was wondering if there is any way in which I can refresh the summary table with the token values selected?

In other words, if token 1 is set but token 2 is unset, then

BASE SEARCH | search token1=$token1$, token2=* (since token 2 is not set yet)

If token 1 and token 2 is set, then 

BASE SEARCH | search token1=$token1$, token2=$token2$ (as both tokens are set.

Eventually what I am trying to do is keep refreshing the dashboard based on user clicks, but if at the moment, unless user sets the token1 and token2, my dashboard panel is not showing anything. It is stuck at "waiting for user input".  

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can create and init block at the top of the dashboard source to set your token on dashboard load

<init>
  <set token="token1">*</set>
  <set token="token2">*</set>
</init>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can create and init block at the top of the dashboard source to set your token on dashboard load

<init>
  <set token="token1">*</set>
  <set token="token2">*</set>
</init>
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...