Dashboards & Visualizations

How to call a token in token

nagarjuna560
New Member

How do I use a token in another token?

I get results from the dashboard, and I put that in org token:

set token="org" $result.org$ set

values= of org is, field1=$name$, filed2=$department$

When I call the org token in a dashboard panel, I am getting a null value.

0 Karma

woodcock
Esteemed Legend

To set:

<set token="global_org" $result.org$</set>

To access (anywhere except for the search where it is being set):

 ... The org is $global_org$.
0 Karma

nagarjuna560
New Member

OneTokenAsValueForAnotherToken

<input type="dropdown" token="arguments">
<label>arguments:</label>
       <choice value="*">All</choice>
       <search>
         <query> |inputlookup lookup_name | table arguments</query>
       </search>
       <default>*</default>
       <fieldForLabel>arguments</fieldForLabel>
       <fieldForValue>arguments</fieldForValue>
     </input>        


<label>ip</label>


<label>location</label>

<input type="text" token="domain_name">
<label>domain_name</label>


 <table>
   <searchString>index=_internal  | table ip, lcation  | append [| makeresults | $arguments$ ] | table ip, lcation    </searchString>
   <earliestTime>-60m@m</earliestTime>
   <latestTime>now</latestTime>
 </table>
0 Karma

nagarjuna560
New Member

OneTokenAsValueForAnotherToken

<input type="dropdown" token="arguments">
<label>arguments:</label>
       <choice value="*">All</choice>
       <search>
         <query> |inputlookup lookup_name | table arguments</query>
       </search>
       <default>*</default>
       <fieldForLabel>arguments</fieldForLabel>
       <fieldForValue>arguments</fieldForValue>
     </input>        


<label>ip</label>


<label>location</label>

<input type="text" token="domain_name">
<label>domain_name</label>


 <table>
   <searchString>index=_internal  | table ip, lcation  | append [| makeresults | $arguments$ ] | table ip, lcation    </searchString>
   <earliestTime>-60m@m</earliestTime>
   <latestTime>now</latestTime>
 </table>

the above lookup contains fileds called arguments and values like

ip=$ip$, location=$location$
ip=$ip$
domain_name=$domain_name$
location=$loaction$
domanin=$domain$ location=$location$
etc

I select $arguments$ from dropdown, search contains $arguments$ token and token values will be values of lookup table, values cantains token like ip, location, domain etc. token value changes based on drop-down selection.
I am getting null in results, without input(ip,location and domain_name etc) splunk running table search

0 Karma

woodcock
Esteemed Legend

Try escaping by using two $ like this $$name$$.

0 Karma

nagarjuna560
New Member

My question is Like below question
https://answers.splunk.com/answers/138803/set-token-in-the-value-of-another-token.html

but this solution is not working, I am using splunk 7.1

your solution is not working

0 Karma

woodcock
Esteemed Legend

Your question is poorly phrased. This is not a token in a token, it is one field's token used in another field's populating search, which is very different. I will post an appropriate answer now that the question is clearer.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@nagarjuna560,

Is it possible to share the xml part?

Happy Splunking!
0 Karma

nagarjuna560
New Member
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...