Dashboards & Visualizations

How to clear/reset the value of a token?

Mario
Engager

Hello all.

I am making a dashboard in which I was in the need to create a  subsearch.  This is the piece of code that does it:

 

<panel>
<title>random panel title</title>
<table depends="$show_debug$">
<search id="Build_list">
<query>index= here it goes my query |fields * |table important_field |format</query>
<finalized>
<condition match=" 'job.resultCount' != 0">
<set token="my_list">$result.search$</set>
</condition>
<condition>
<unset token="my_list"></unset>
</condition>
</finalized>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<title>another panel</title>
<html depends="$show_debug$">
<h3>$my_list$</h3>
</html>
</panel>

 

and here I am using the $my_list$ token:

 

<search>
<query>$my_list$ | foreach
something.* [rename "&lt;&lt;FIELD&gt;&gt;" as
"&lt;&lt;MATCHSEG1&gt;&gt;"]
| stats
values(Url),values(UrlDomain)</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>

 

 

This worked well the first time,  but now,  for every new query I do, no matter if I close and open a new browser/splunk session,  I see still the results of the first query I did.  is like  $my_list$ has the first ever values hardened and I cannot reset them.  I though that <unset token="my_list"></unset> would clear it but not....

 

Any help please?  The goal here is to use this $my_list$ token, which is a splunk query  (note the |format at the end of the query)  but of course this token needs to be empty every time I run a new query.

 

Thanks a lot in advance.

Mario

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Mario,

in the input section, you could add a panel like this (obviously to adapt to your tokes:

    <input type="radio" token="resetTokens" searchWhenChanged="true">
      <label></label>
      <choice value="reset">Reset Inputs</choice>
      <choice value="retain">Retain</choice>
      <default>retain</default>
      <change>
        <condition value="reset">
          <unset token="token1"></unset>
          <unset token="token2"></unset>
          <unset token="token3"></unset>
          <set token="resetTokens">retain</set>
        </condition>
      </change>
    </input>

Ciao.

Giuseppe

View solution in original post

makelovenotwar
Path Finder

how would I do this with a *link* field type? I just want a button that says 'SUBMIT" so the user can reset the tokens.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @makelovenotwar,

you can do this using a JavaScript, but I'm not an expert in JS so I cannot help you more.

But using my solution, you have a reset button in the header bar.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @Mario,

in the input section, you could add a panel like this (obviously to adapt to your tokes:

    <input type="radio" token="resetTokens" searchWhenChanged="true">
      <label></label>
      <choice value="reset">Reset Inputs</choice>
      <choice value="retain">Retain</choice>
      <default>retain</default>
      <change>
        <condition value="reset">
          <unset token="token1"></unset>
          <unset token="token2"></unset>
          <unset token="token3"></unset>
          <set token="resetTokens">retain</set>
        </condition>
      </change>
    </input>

Ciao.

Giuseppe

Mario
Engager

Ciao Beppe!

I am so sorry I thought I marked your reply as solution before. I have just done it now.  

Grazie mille!

kukasky
Observer

This solution is for classic dashboard. How do it in Dashboard studio ?

Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to use another search to (conditionally) set the result field to null and use the results tokens from the search. For example:

{
    "visualizations": {
        "viz_F0Z9jsFU": {
            "type": "splunk.singlevalue",
            "title": "Speed in km/h",
            "dataSources": {
                "primary": "ds_eZ6LtdAT"
            },
            "options": {
                "unit": "km/h"
            }
        },
        "viz_p4tcz9dd": {
            "type": "splunk.singlevalue",
            "dataSources": {
                "primary": "ds_RopRdHUj"
            },
            "title": "Speed in mph",
            "options": {
                "unit": "mph"
            },
            "description": "$km per hour : result.kmh$ * 0.621"
        }
    },
    "dataSources": {
        "ds_eZ6LtdAT": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults\n| eval kmh=random()%100",
                "enableSmartSources": true
            },
            "name": "km per hour"
        },
        "ds_RopRdHUj": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults\n| eval speed_in_mph = if($km per hour:result.kmh$ > 50, $km per hour:result.kmh$ * 0.621, null())\n| table speed_in_mph"
            },
            "name": "kmh to mph"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type": "input.timerange",
            "options": {
                "token": "global_time",
                "defaultValue": "-24h@h,now"
            },
            "title": "Global Time Range"
        }
    },
    "layout": {
        "type": "absolute",
        "options": {
            "width": 1440,
            "height": 960,
            "display": "auto"
        },
        "structure": [
            {
                "item": "viz_F0Z9jsFU",
                "type": "block",
                "position": {
                    "x": 10,
                    "y": 10,
                    "w": 250,
                    "h": 250
                }
            },
            {
                "item": "viz_p4tcz9dd",
                "type": "block",
                "position": {
                    "x": 290,
                    "y": 10,
                    "w": 250,
                    "h": 250
                }
            }
        ],
        "globalInputs": [
            "input_global_trp"
        ]
    },
    "description": "",
    "title": "Evaluate tokens using search"
}

Adapted from documentation example here 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...