Dashboards & Visualizations

Form (Dashboard) global initial token issue

abzmhzsplunk
New Member

Hi,

I have defined global token for init section. When use it later in the search (see below), it won't work (the search is waiting for input forever). Any help? Thanks.

<form>
  <label>Report</label>

  <init>
    <set token="kpiTotalMS_SLA">6688</set>
  </init>

......
 <searchString>index=* 
      | eval baseline_ms=$kpiTotalMS_SLA$
......
</form>
0 Karma

cmerriman
Super Champion

try this, without SearchString and with Query:

<form>
    <label>test4</label>

    <init>
      <set token="kpiTotalMS_SLA">6688</set>
    </init>

    <fieldset autoRun="true" submitButton="false">
     <input type="time" searchWhenChanged="true">
       <default>
         <earliestTime>-15m</earliestTime>
         <latestTime>now</latestTime>
       </default>
     </input>
   </fieldset>

   <row>
     <panel>
       <chart>
         <title>ResponseTime-Timechart</title>
         <search>
           <query>index=* kpiTotalMS 
                      | eval baseline_ms=$kpiTotalMS_SLA$
                      | timechart avg(kpiTotalMS), first(baseline_ms) as baseline</query>
         </search>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
   </row>
 </form>
0 Karma

cmerriman
Super Champion

have you tried this?

0 Karma

altink
Builder

Tokens only in lower case?

0 Karma

hallt3
Path Finder

Not the issue. you can do cases in tokens

0 Karma

woodcock
Esteemed Legend

Give us all the XML. You are mistaken about what the problem is. There is nothing wrong with this token.

0 Karma

abzmhzsplunk
New Member

Here is the full XML.
If you change "eval baseline_ms=$kpiTotalMS_SLA$" to "eval baseline_ms=6688" it works.
With the token it is just displayed " Search is waiting for input... "

<form>
   <label>Report</label>

   <init>
     <set token="kpiTotalMS_SLA">6688</set>
   </init>

   <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default>
        <earliestTime>-15m</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
  </fieldset>

  <row>
    <panel>
      <chart>
        <title>ResponseTime-Timechart</title>
        <searchString>index=* kpiTotalMS 
                     | eval baseline_ms=$kpiTotalMS_SLA$
                     | timechart avg(kpiTotalMS), first(baseline_ms) as baseline
        </searchString>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

abzmhzsplunk
New Member

Still not working.

Looks like the Init section is not working. from above another suggestion for print the token, it displayed as:
baseline_ms: $kpiTotalMS_SLA$

Any other ways to set token or global constant?

0 Karma

niketn
Legend

Are you on version 6.5 or later? Can you try something like the following to ensure token is populated?

 <form>
   <label>Report</label>

   <init>
     <set token="kpiTotalMS_SLA">6688</set>
   </init>

 ......
  <search>
    <query>|makeresults 
       | eval baseline_ms=$kpiTotalMS_SLA$
       | table baseline_ms
    </query>
   </search>
 ......
 </form>

You can also print token as part of panel/visualization title or directly as html panel within any panel

<panel>
    <html>
        <div>baseline_ms: $kpiTotalMS_SLA$
        </div>
    </html>
</panel>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

abzmhzsplunk
New Member

Looks like the token assignment is not working from the Init.
It displayed as:
baseline_ms: $kpiTotalMS_SLA$

0 Karma

cmerriman
Super Champion

try putting script="showtokens.js" in the form to see if that token is generated properly. it works great for debugging tokens.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...