Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Dynamic drilldown - set default token value
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dynamic drilldown - set default token value
My dashboard has a timechart and a table. When the user clicks on a table serie label, the table displays events.
My table has a dependency on the token, so until the user doesn't click, it doesn't show...
I want to have the table always on display.
Is there any way to define a default value for the token?
I've tried this....to remove the dependency and do an | eval tempvalue=ifnotnull($type_tok$, "VALUE", $type_tok$) | ... (using tempvalue)
but it didn't work.
Thanks!!
< table depends="$type_tok$">
< title>Last $type_tok$< /title>
< searchString>| datamodel TEST OBJ1 search | search OBJ1.Result=$type_tok$| table _time, User, Access, LTime< /searchString>
< option name="type">list< /option>
< option name="drilldown">none< /option>
< option name="count">5< /option>
< /table>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In Splunk 6.5 this is now supported natively in Simple XML. See the Set tokens on page load. Example below:
<form>
<init>
<set token="myToken">initialValue</set>
</init>
...
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this.
<form>
<label>TestDynamicDropdown</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="sourcetype">
<label>field10</label>
<default>splunkd</default>
<seed>splunkd</seed>
</input>
<html>
<style>
.input#field1 {
display: none;
}
</style>
</html>
</fieldset>
<row>
<panel>
<table>
<searchString>index=_internal | stats count by sourcetype</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">10</option>
<drilldown>
<set token="sourcetype">$row.sourcetype$</set>
</drilldown>
</table>
<table id="detail" depends="$sourcetype$">
<searchString>index=_internal $sourcetype$| stats count by sourcetype</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Description: Make an input field that has a default value for the token so it is set and the 1st search runs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Team,
I have requirement to set default/Initial token value dynamically while form load.
Below search script I have to fetch the color.
search...| table color
The requirement is to set the background color for panel dynamically based on the search script. I don't want to click on any button or dropdown to set the color.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming this is a Simple XML page, you can add a JS extension that sets the token on page load.
The dashboard:
<dashboard script="my_dashboard.js">
The JS file:
require(['splunkjs/ready!'], function(mvc) {
var tokens = mvc.Components.get('default');
tokens.set('myToken', 'initialValue');
});
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think the require in the above example is missing "splunkjs/mvc", like so:
require(["splunkjs/mvc", "splunkjs/mvc/simplexml/ready!"], ...
The OpenTelemetry Certified Associate (OTCA) Exam
From Manual to Agentic: Level Up Your SOC at Cisco Live
Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)
