Dashboards & Visualizations

Global Variable in splunk dashboard

reney44
Engager

how to set and get Global variable across splunk dashboard

there is no possible way to access variable in multiple search,
scope of variable include inside a search or macro

Tags (2)
0 Karma
1 Solution

nick405060
Motivator

To set, e.g:

<search>
  <query>
| makeresults | eval myvar="this is my variable" | table myvar
  </query>
  <preview>
    <set token="access_me">$result.myvar$</set>
  </preview>
</search>

To get:

... | eval this_is_somewhere_else_in_my_code="$access_me$"

However, remember that SimpleXML replaces the token with its value and THEN evaluates the SimpleXML. So if you were to not wrap your token in quotes like ... | eval this_is_somewhere_else_in_my_code=$access_me$, it would be evaluated as ... | eval this_is_somewhere_else_in_my_code=this is my variable instead of ... | eval this_is_somewhere_else_in_my_code="this is my variable" and therefore break your SimpleXML code.

Not wrapping your token in quotes is sometimes desirable, e.g. if you want to dynamically modify your SPL or SimpleXML code itself. However most of the time especially in a <query> stanza you are going to want to wrap your token in quotes.

View solution in original post

nick405060
Motivator

To set, e.g:

<search>
  <query>
| makeresults | eval myvar="this is my variable" | table myvar
  </query>
  <preview>
    <set token="access_me">$result.myvar$</set>
  </preview>
</search>

To get:

... | eval this_is_somewhere_else_in_my_code="$access_me$"

However, remember that SimpleXML replaces the token with its value and THEN evaluates the SimpleXML. So if you were to not wrap your token in quotes like ... | eval this_is_somewhere_else_in_my_code=$access_me$, it would be evaluated as ... | eval this_is_somewhere_else_in_my_code=this is my variable instead of ... | eval this_is_somewhere_else_in_my_code="this is my variable" and therefore break your SimpleXML code.

Not wrapping your token in quotes is sometimes desirable, e.g. if you want to dynamically modify your SPL or SimpleXML code itself. However most of the time especially in a <query> stanza you are going to want to wrap your token in quotes.

CarbonCriterium
Path Finder

@nick405060

This works for me, but my global variable is the sum of a very lengthy search.  

For as long as the search that creates the global variable is running, the search that uses starts, cancels itself, and then starts again, over and over and over.  All searches eventually run as expected, but its not pretty to look at.  

Is there a way to hold the dependent search from starting until the global variable has been created?

0 Karma

jpolvino
Builder

One "sneaky" way to do this is to provide the value in the dashboard URL:

https://your.splunk.url/en-US/app/search/dashboardname?yourtoken=yourtokenval

Then in your dashboard, you can use $yourtoken$ in searches and titles. Just be sure to URL encode youtokenval so it will parse properly.

This works great is you bookmark the dashboard, or want to test it out. If you just let people navigate to the dashboards, they won't get this additional key/val.

niketn
Legend

@reney44 tokens once they are set in a dashboard are available across the dashboard. So for the community to assist you better please elaborate as to what you are trying to do? How is the token being set? Is it in <init> section, or through search event handler, or through visualization drilldown? Which all places do you want to use the token in the dashboard? If you have already set the token what is the issue while using it in macro? Does your macro have a parameter so that it can accept the token as input?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...