Dashboards & Visualizations

Default Token - Dashboard Studio

arielc
New Member

Hi Splunkers,

Per this documentation - https://docs.splunk.com/Documentation/Splunk/latest/DashStudio/tokens - setting default value is done by navigating to the Interactions section of the Configuration panel.

This is simple with the given example with the token set as $method$.

"tokens": {
      "default": {
        "method": {
          "value": "GET"
        }
      }
    }

 

Would anyone be able to advise as to how can I set default tokens of a dashboard (created using Dashboard Studio) if the value is of the panel is pointing to a data source whose query has a dependency to another data source's results?

Panel A:
Data Source:
'Alpha status'

'Alpha status' query:
| eval status=$Beta status:result._statusNumber$

 

arielc_0-1733987163625.png

 

e.g. I need to set a default token value for $Beta status:result._statusNumber$


Thanks in advance for the response.

Labels (1)
0 Karma

shonias
Explorer

I don't think I understand what you're trying to do. $Beta status:result._statusNumber$ is a token set by your search, "Beta status", and therefore has no default value. The screenshot you've shown is for setting tokens when users click on a visualisation. The two things are not related, really, other than how they are used in source code. 

What issue are you trying to solve, exactly? If the token isn't working, have you made sure you've checked the "Access search results or metadata" box in the data source config? 

dural_yyz
Motivator

I mean the default value option is literally right at the bottom of the image you posted.  So that is how you set the default value of that token before any event can manipulate the expected outcome value.

I'm hoping you are actually experiencing something more complicated and that maybe I don't fully understand your use case yet.  But really any other outcome means the value is conditionally set due to some other event occurring so I don't know how to advise.

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...