Dashboards & Visualizations

How do you pass the value of a token into a dashboard that is being used to set another token?

eurban
Explorer

I have a dashboard with a text input box that is used to populate a second token on that page. This second token is tied to a radio selector and the purpose of this second token is to populate part of a search depending on the radio button selected.

The search in this case is | makeresults | eval msg=$radio_input_search$, seq=1. The radio_input_search token is populated with the text input value only when a radio button other than "Disabled" is selected. When "Disabled is selected, then there is a default value for the token.

Here is a screenshot that show the dashboard:
alt text

This seems to work fine for me when I make changes to the text input and click on the different radio buttons directly on the dashboard. The problem is when I try to link to this dashboard from a drilldown of another dashboard, which can be simulated by using a URL with the tokens set in the URL params. The code for the dashboard is pasted below for reference. If you use a URL like https://splunk_url.com/app/my_app/testing_tokens?form.text_input=here%20is%20text&form.radio_input=a, the value of the msg field in this case will be set to "Text input is empty" when the dashboard loads. I believe this is a timing issue, and on page load when radio_input_search is set it doesn't yet have a value for text_input so it ends up being set to "Text input is empty".

I tried to simplify my example from the actual dashboard I am working on, but the end goal is that I need a way control whether or not a part of a search exists or is empty depending on the radio button selected. The part of the query that may or may not exist also has a token in it that is because the radio buttons control a part of that as well. Hopefully that makes sense.

Here is the dashboard:

<form>
  <label>testing_tokens</label>
  <fieldset submitButton="false">
    <input type="text" token="text_input" searchWhenChanged="true">
      <label>Text input</label>
      <initialValue></initialValue>
    </input>
    <input type="radio" token="radio_input" searchWhenChanged="true">
      <label>Radio Input</label>
      <choice value="">Disabled</choice>
      <choice value="a">Active A</choice>
      <choice value="b">Active B</choice>
      <initialValue></initialValue>
      <change>
        <condition label="Disabled">
          <set token="radio_input_search">"none"</set>
        </condition>
        <condition>
          <!--<set token="radio_input_search">"$text_input$_$value$"</set>-->
          <eval token="radio_input_search">if(isnull('text_input') OR 'text_input'="", "\"Text input is empty\"", "\"".'text_input'."_".'value'."\"")</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Panel to test tokens</title>
        <search>
          <query>| makeresults | eval msg=$radio_input_search$, seq=1</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
1 Solution

niketn
Legend

@eurban, you are right about the fact that tokens will be changed one by one. So if you try to code the <change> event of an input on the destination dashboard the other one will be empty. In order to overcome this you can use a dummy search which will run only when both tokens are set in the first place (otherwise they will be waiting for input).

  <search>
    <query>| makeresults 
| fields - _time 
| eval radio_input_search=if(len($text_input|s$)>0 AND len($radio_input|s$)>0 ,$text_input|s$."-".$radio_input|s$,"Text Input is Empty")</query>
    <done>
      <set token="radio_input_search">$result.radio_input_search$</set>
    </done>
  </search>

Please try out and confirm whether following dashboard works as the destination dashboard for source dashboard with input values being passed!

<form>
  <label>area chart</label>
  <search>
    <query>| makeresults 
| fields - _time 
| eval radio_input_search=if(len($text_input|s$)>0 AND len($radio_input|s$)>0 ,$text_input|s$."-".$radio_input|s$,"Text Input is Empty")</query>
    <done>
      <set token="radio_input_search">$result.radio_input_search$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="text_input" searchWhenChanged="true">
      <label>Text input</label>
    </input>
    <input type="radio" token="radio_input" searchWhenChanged="true">
      <label>Radio Input</label>
      <choice value="">Disabled</choice>
      <choice value="a">Active A</choice>
      <choice value="b">Active B</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$radio_input_search$</title>
      <table>
        <title>Panel to test tokens</title>
        <search>
          <query>| makeresults | eval msg=$radio_input_search|s$, seq=1</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@eurban, you are right about the fact that tokens will be changed one by one. So if you try to code the <change> event of an input on the destination dashboard the other one will be empty. In order to overcome this you can use a dummy search which will run only when both tokens are set in the first place (otherwise they will be waiting for input).

  <search>
    <query>| makeresults 
| fields - _time 
| eval radio_input_search=if(len($text_input|s$)>0 AND len($radio_input|s$)>0 ,$text_input|s$."-".$radio_input|s$,"Text Input is Empty")</query>
    <done>
      <set token="radio_input_search">$result.radio_input_search$</set>
    </done>
  </search>

Please try out and confirm whether following dashboard works as the destination dashboard for source dashboard with input values being passed!

<form>
  <label>area chart</label>
  <search>
    <query>| makeresults 
| fields - _time 
| eval radio_input_search=if(len($text_input|s$)>0 AND len($radio_input|s$)>0 ,$text_input|s$."-".$radio_input|s$,"Text Input is Empty")</query>
    <done>
      <set token="radio_input_search">$result.radio_input_search$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="text_input" searchWhenChanged="true">
      <label>Text input</label>
    </input>
    <input type="radio" token="radio_input" searchWhenChanged="true">
      <label>Radio Input</label>
      <choice value="">Disabled</choice>
      <choice value="a">Active A</choice>
      <choice value="b">Active B</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$radio_input_search$</title>
      <table>
        <title>Panel to test tokens</title>
        <search>
          <query>| makeresults | eval msg=$radio_input_search|s$, seq=1</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

eurban
Explorer

This works great, thank you!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...