Dynamic drilldown - set default token value

snemiro_514 · ‎09-12-2014

My dashboard has a timechart and a table. When the user clicks on a table serie label, the table displays events.

My table has a dependency on the token, so until the user doesn't click, it doesn't show...

I want to have the table always on display.

Is there any way to define a default value for the token?
I've tried this....to remove the dependency and do an | eval tempvalue=ifnotnull($type_tok$, "VALUE", $type_tok$) | ... (using tempvalue)

but it didn't work.

Thanks!!

< table depends="$type_tok$">

< title>Last $type_tok$< /title>

< searchString>| datamodel TEST OBJ1 search | search OBJ1.Result=$type_tok$| table _time, User, Access, LTime< /searchString>

< option name="type">list< /option>

< option name="drilldown">none< /option>

< option name="count">5< /option>

< /table>

Lowell · ‎10-19-2016

In Splunk 6.5 this is now supported natively in Simple XML. See the Set tokens on page load. Example below:

<form>
   <init>
     <set token="myToken">initialValue</set>
  </init>
...
</form>

somesoni2 · ‎09-15-2014

Try this.

<form>
  <label>TestDynamicDropdown</label>
  <fieldset submitButton="false" autoRun="true">
   <input type="text" token="sourcetype">
      <label>field10</label>
      <default>splunkd</default>
     <seed>splunkd</seed>
    </input>
    <html>
       <style>
         .input#field1 {
           display: none;
         } 
    </style>

    </html>
</fieldset>
  <row>
    <panel>
      <table>
        <searchString>index=_internal | stats count by sourcetype</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown>
          <set token="sourcetype">$row.sourcetype$</set>
        </drilldown>
      </table>
      <table id="detail" depends="$sourcetype$">
        <searchString>index=_internal $sourcetype$| stats count by sourcetype</searchString>
        <earliestTime>-60m@m</earliestTime>
        <latestTime>now</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>        
      </table>
    </panel>
  </row>
</form>

vcgamesii · ‎02-04-2016

Description: Make an input field that has a default value for the token so it is set and the 1st search runs.

abhishekgupta61 · ‎07-25-2018

Hi Team,

I have requirement to set default/Initial token value dynamically while form load.
Below search script I have to fetch the color.

search...| table color

The requirement is to set the background color for panel dynamically based on the search script. I don't want to click on any button or dropdown to set the color.

dfoster_splunk · ‎09-15-2014

Assuming this is a Simple XML page, you can add a JS extension that sets the token on page load.

The dashboard:

<dashboard script="my_dashboard.js">

The JS file:

require(['splunkjs/ready!'], function(mvc) {
    var tokens = mvc.Components.get('default');
    tokens.set('myToken', 'initialValue');
});

Lowell · ‎10-19-2016

I think the require in the above example is missing "splunkjs/mvc", like so:

require(["splunkjs/mvc", "splunkjs/mvc/simplexml/ready!"], ...

Dynamic drilldown - set default token value

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?