Handling splunk dashboard token

[kranthimutyala]

Hi All,

I have a dashboard which contains 2 inputs(both are text fields ).But the user can give the values in both the text fields or he can give only in one of the text fields leaving the other one blank(but the query in the panel doesn't work if any of the token is null)

So when he gives the input in first field the second should be * and vice versa.
But i do want to show the * in the text box by setting up it in the default value

Or how can i ignore the second token(assuming nothing is provided) in the panel search query so that it can generate the results based on one token

Sample query in the panel : index=abc event=$token1$ agent=$token2$ | table action object

Can someone help me on how to handle this situation.

Thank you in advance

[gaurav_maniar · Accepted solution]

Hi,

below code will resolve your issue,

<input type="text" token="tok2">
    <label>field2</label>
    <default>*</default>
</input>

Accept and upvote the answer if it helps.

happy splunking........!!!!

[kranthimutyala]

This will show (*) as default values but i want to hide it in the back bot showing up to the user

[Anantha123]

Hi , Try below . Give space in default.

  <label>field1</label>
  <default></default>
</input>

[kranthimutyala]

thats not working

[kranthimutyala]

Please find the below code.In the below code whenever user doesn't specify any value for either source/log_level it must be replaced with *.
But i don't want to use * in default value as user doesn't want to see that.So need your help in handling this token whenever it is null change it to * internally using eval.Thank you

input_test

<input type="text" token="src">
  <label>specify source</label>
</input>
<input type="text" token="log">
  <label>log_level</label>
</input>
<input type="time" token="field1">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <table>
    <search>
      <query>index=_internal sourcetype=$src$ log_level=$log$|table sourcetype log_level</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table>
</panel>

[gaurav_maniar]

Hi,

If your are fine with using javascript, below code will work,

<form script="default_token.js">
  <label>Default Token</label>
  <fieldset submitButton="true">
    <input type="text" token="token1">
      <label>Field</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Default Token</title>
      <table>
        <search>
          <query>index=_internal sourcetype=$token1$ | head 1 | table _time, _raw</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

default_token.js
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView, SearchManager) {

    var tokens = mvc.Components.get("default");

    $(document).on("click", "#submit", function(e){
        var tok1 = tokens.get("token1");

        if (tok1 == undefined || tok1 == ""){
            tokens.set("token1", "*");
        }
    });
});

[kranthimutyala]

$(document).on("click", "#submit", function(e){
var tok2 = tokens.get("token2");

     if (tok2 == undefined || tok2 == ""){
         tokens.set("token2", "*");

I have added this snippet for token2, but its not working .Can you please help me with the script for more than one token change

[kranthimutyala]

@gaurav_maniar Thanks for your answer, its working well.Thank you very much

[kranthimutyala]

require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView, SearchManager) {

 var tokens = mvc.Components.get("default");

 $(document).on("click", "#submit", function(e){
     var tok1 = tokens.get("token1");

     if (tok1 == undefined || tok1 == ""){
         tokens.set("token1", "*");
     }
 });

 $(document).on("click", "#submit", function(e){
     var tok2 = tokens.get("token1");

     if (tok2 == undefined || tok2 == ""){
         tokens.set("token2", "*");
     }
 });

});

this code is not working , i want to implement this for two tokens

[tomawest]

Set the default value for both text fields to *.
Your issue is that the token is unset when nothing is entered in.