Dashboards & Visualizations

Global Variable in splunk dashboard

Engager

how to set and get Global variable across splunk dashboard

there is no possible way to access variable in multiple search,
scope of variable include inside a search or macro

Tags (2)
0 Karma
1 Solution

Motivator

To set, e.g:

<search>
  <query>
| makeresults | eval myvar="this is my variable" | table myvar
  </query>
  <preview>
    <set token="access_me">$result.myvar$</set>
  </preview>
</search>

To get:

... | eval this_is_somewhere_else_in_my_code="$access_me$"

However, remember that SimpleXML replaces the token with its value and THEN evaluates the SimpleXML. So if you were to not wrap your token in quotes like ... | eval this_is_somewhere_else_in_my_code=$access_me$, it would be evaluated as ... | eval this_is_somewhere_else_in_my_code=this is my variable instead of ... | eval this_is_somewhere_else_in_my_code="this is my variable" and therefore break your SimpleXML code.

Not wrapping your token in quotes is sometimes desirable, e.g. if you want to dynamically modify your SPL or SimpleXML code itself. However most of the time especially in a <query> stanza you are going to want to wrap your token in quotes.

View solution in original post

Motivator

To set, e.g:

<search>
  <query>
| makeresults | eval myvar="this is my variable" | table myvar
  </query>
  <preview>
    <set token="access_me">$result.myvar$</set>
  </preview>
</search>

To get:

... | eval this_is_somewhere_else_in_my_code="$access_me$"

However, remember that SimpleXML replaces the token with its value and THEN evaluates the SimpleXML. So if you were to not wrap your token in quotes like ... | eval this_is_somewhere_else_in_my_code=$access_me$, it would be evaluated as ... | eval this_is_somewhere_else_in_my_code=this is my variable instead of ... | eval this_is_somewhere_else_in_my_code="this is my variable" and therefore break your SimpleXML code.

Not wrapping your token in quotes is sometimes desirable, e.g. if you want to dynamically modify your SPL or SimpleXML code itself. However most of the time especially in a <query> stanza you are going to want to wrap your token in quotes.

View solution in original post

Builder

One "sneaky" way to do this is to provide the value in the dashboard URL:

https://your.splunk.url/en-US/app/search/dashboardname?yourtoken=yourtokenval

Then in your dashboard, you can use $yourtoken$ in searches and titles. Just be sure to URL encode youtokenval so it will parse properly.

This works great is you bookmark the dashboard, or want to test it out. If you just let people navigate to the dashboards, they won't get this additional key/val.

SplunkTrust
SplunkTrust

@reney44 tokens once they are set in a dashboard are available across the dashboard. So for the community to assist you better please elaborate as to what you are trying to do? How is the token being set? Is it in <init> section, or through search event handler, or through visualization drilldown? Which all places do you want to use the token in the dashboard? If you have already set the token what is the issue while using it in macro? Does your macro have a parameter so that it can accept the token as input?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma