Dashboards & Visualizations

How do you pass the value of a token into a dashboard that is being used to set another token?

eurban
Explorer

I have a dashboard with a text input box that is used to populate a second token on that page. This second token is tied to a radio selector and the purpose of this second token is to populate part of a search depending on the radio button selected.

The search in this case is | makeresults | eval msg=$radio_input_search$, seq=1. The radio_input_search token is populated with the text input value only when a radio button other than "Disabled" is selected. When "Disabled is selected, then there is a default value for the token.

Here is a screenshot that show the dashboard:
alt text

This seems to work fine for me when I make changes to the text input and click on the different radio buttons directly on the dashboard. The problem is when I try to link to this dashboard from a drilldown of another dashboard, which can be simulated by using a URL with the tokens set in the URL params. The code for the dashboard is pasted below for reference. If you use a URL like https://splunk_url.com/app/my_app/testing_tokens?form.text_input=here%20is%20text&form.radio_input=a, the value of the msg field in this case will be set to "Text input is empty" when the dashboard loads. I believe this is a timing issue, and on page load when radio_input_search is set it doesn't yet have a value for text_input so it ends up being set to "Text input is empty".

I tried to simplify my example from the actual dashboard I am working on, but the end goal is that I need a way control whether or not a part of a search exists or is empty depending on the radio button selected. The part of the query that may or may not exist also has a token in it that is because the radio buttons control a part of that as well. Hopefully that makes sense.

Here is the dashboard:

<form>
  <label>testing_tokens</label>
  <fieldset submitButton="false">
    <input type="text" token="text_input" searchWhenChanged="true">
      <label>Text input</label>
      <initialValue></initialValue>
    </input>
    <input type="radio" token="radio_input" searchWhenChanged="true">
      <label>Radio Input</label>
      <choice value="">Disabled</choice>
      <choice value="a">Active A</choice>
      <choice value="b">Active B</choice>
      <initialValue></initialValue>
      <change>
        <condition label="Disabled">
          <set token="radio_input_search">"none"</set>
        </condition>
        <condition>
          <!--<set token="radio_input_search">"$text_input$_$value$"</set>-->
          <eval token="radio_input_search">if(isnull('text_input') OR 'text_input'="", "\"Text input is empty\"", "\"".'text_input'."_".'value'."\"")</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Panel to test tokens</title>
        <search>
          <query>| makeresults | eval msg=$radio_input_search$, seq=1</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
1 Solution

niketn
Legend

@eurban, you are right about the fact that tokens will be changed one by one. So if you try to code the <change> event of an input on the destination dashboard the other one will be empty. In order to overcome this you can use a dummy search which will run only when both tokens are set in the first place (otherwise they will be waiting for input).

  <search>
    <query>| makeresults 
| fields - _time 
| eval radio_input_search=if(len($text_input|s$)>0 AND len($radio_input|s$)>0 ,$text_input|s$."-".$radio_input|s$,"Text Input is Empty")</query>
    <done>
      <set token="radio_input_search">$result.radio_input_search$</set>
    </done>
  </search>

Please try out and confirm whether following dashboard works as the destination dashboard for source dashboard with input values being passed!

<form>
  <label>area chart</label>
  <search>
    <query>| makeresults 
| fields - _time 
| eval radio_input_search=if(len($text_input|s$)>0 AND len($radio_input|s$)>0 ,$text_input|s$."-".$radio_input|s$,"Text Input is Empty")</query>
    <done>
      <set token="radio_input_search">$result.radio_input_search$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="text_input" searchWhenChanged="true">
      <label>Text input</label>
    </input>
    <input type="radio" token="radio_input" searchWhenChanged="true">
      <label>Radio Input</label>
      <choice value="">Disabled</choice>
      <choice value="a">Active A</choice>
      <choice value="b">Active B</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$radio_input_search$</title>
      <table>
        <title>Panel to test tokens</title>
        <search>
          <query>| makeresults | eval msg=$radio_input_search|s$, seq=1</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@eurban, you are right about the fact that tokens will be changed one by one. So if you try to code the <change> event of an input on the destination dashboard the other one will be empty. In order to overcome this you can use a dummy search which will run only when both tokens are set in the first place (otherwise they will be waiting for input).

  <search>
    <query>| makeresults 
| fields - _time 
| eval radio_input_search=if(len($text_input|s$)>0 AND len($radio_input|s$)>0 ,$text_input|s$."-".$radio_input|s$,"Text Input is Empty")</query>
    <done>
      <set token="radio_input_search">$result.radio_input_search$</set>
    </done>
  </search>

Please try out and confirm whether following dashboard works as the destination dashboard for source dashboard with input values being passed!

<form>
  <label>area chart</label>
  <search>
    <query>| makeresults 
| fields - _time 
| eval radio_input_search=if(len($text_input|s$)>0 AND len($radio_input|s$)>0 ,$text_input|s$."-".$radio_input|s$,"Text Input is Empty")</query>
    <done>
      <set token="radio_input_search">$result.radio_input_search$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="text_input" searchWhenChanged="true">
      <label>Text input</label>
    </input>
    <input type="radio" token="radio_input" searchWhenChanged="true">
      <label>Radio Input</label>
      <choice value="">Disabled</choice>
      <choice value="a">Active A</choice>
      <choice value="b">Active B</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$radio_input_search$</title>
      <table>
        <title>Panel to test tokens</title>
        <search>
          <query>| makeresults | eval msg=$radio_input_search|s$, seq=1</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

eurban
Explorer

This works great, thank you!

Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...