Dashboards & Visualizations

Form (Dashboard) global initial token issue

abzmhzsplunk
New Member

Hi,

I have defined global token for init section. When use it later in the search (see below), it won't work (the search is waiting for input forever). Any help? Thanks.

<form>
  <label>Report</label>

  <init>
    <set token="kpiTotalMS_SLA">6688</set>
  </init>

......
 <searchString>index=* 
      | eval baseline_ms=$kpiTotalMS_SLA$
......
</form>
0 Karma

cmerriman
Super Champion

try this, without SearchString and with Query:

<form>
    <label>test4</label>

    <init>
      <set token="kpiTotalMS_SLA">6688</set>
    </init>

    <fieldset autoRun="true" submitButton="false">
     <input type="time" searchWhenChanged="true">
       <default>
         <earliestTime>-15m</earliestTime>
         <latestTime>now</latestTime>
       </default>
     </input>
   </fieldset>

   <row>
     <panel>
       <chart>
         <title>ResponseTime-Timechart</title>
         <search>
           <query>index=* kpiTotalMS 
                      | eval baseline_ms=$kpiTotalMS_SLA$
                      | timechart avg(kpiTotalMS), first(baseline_ms) as baseline</query>
         </search>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
   </row>
 </form>
0 Karma

cmerriman
Super Champion

have you tried this?

0 Karma

altink
Builder

Tokens only in lower case?

0 Karma

hallt3
Path Finder

Not the issue. you can do cases in tokens

0 Karma

woodcock
Esteemed Legend

Give us all the XML. You are mistaken about what the problem is. There is nothing wrong with this token.

0 Karma

abzmhzsplunk
New Member

Here is the full XML.
If you change "eval baseline_ms=$kpiTotalMS_SLA$" to "eval baseline_ms=6688" it works.
With the token it is just displayed " Search is waiting for input... "

<form>
   <label>Report</label>

   <init>
     <set token="kpiTotalMS_SLA">6688</set>
   </init>

   <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default>
        <earliestTime>-15m</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
  </fieldset>

  <row>
    <panel>
      <chart>
        <title>ResponseTime-Timechart</title>
        <searchString>index=* kpiTotalMS 
                     | eval baseline_ms=$kpiTotalMS_SLA$
                     | timechart avg(kpiTotalMS), first(baseline_ms) as baseline
        </searchString>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

abzmhzsplunk
New Member

Still not working.

Looks like the Init section is not working. from above another suggestion for print the token, it displayed as:
baseline_ms: $kpiTotalMS_SLA$

Any other ways to set token or global constant?

0 Karma

niketn
Legend

Are you on version 6.5 or later? Can you try something like the following to ensure token is populated?

 <form>
   <label>Report</label>

   <init>
     <set token="kpiTotalMS_SLA">6688</set>
   </init>

 ......
  <search>
    <query>|makeresults 
       | eval baseline_ms=$kpiTotalMS_SLA$
       | table baseline_ms
    </query>
   </search>
 ......
 </form>

You can also print token as part of panel/visualization title or directly as html panel within any panel

<panel>
    <html>
        <div>baseline_ms: $kpiTotalMS_SLA$
        </div>
    </html>
</panel>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

abzmhzsplunk
New Member

Looks like the token assignment is not working from the Init.
It displayed as:
baseline_ms: $kpiTotalMS_SLA$

0 Karma

cmerriman
Super Champion

try putting script="showtokens.js" in the form to see if that token is generated properly. it works great for debugging tokens.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...