Dashboards & Visualizations

How to eval a token in the Init part of dashboard based on another token

santosh_sshanbh
Path Finder

I have 2 custom apps as App_A and App_B. I want to hide a panel based on the current app. For that I have used $env:app$ token. 

Now I want to eval a new token in the Init part of the dashboard which will compare the $env:app$ with App_A or App_B and then generate the value for new token.

I tried various options like case, if but no success. Can any one help me in this scenario?

 

 

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I don't think tokens are available at the init phase, so you can do it using a search and a done clause

  <search>
    <query>
      |makeresults
      | eval app="$env:app$"
    </query>
    <done>
      <eval token="app_a">if($result.app$="app_a","App_A",null())</eval>
      <eval token="app_b">if($result.app$="app_b","App_B",null())</eval>
    </done>
  </search>

with the depends="$app_a/b$" in the appropriate panel definition

Hope this helps

View solution in original post

Tags (1)

bowesmana
SplunkTrust
SplunkTrust

I don't think tokens are available at the init phase, so you can do it using a search and a done clause

  <search>
    <query>
      |makeresults
      | eval app="$env:app$"
    </query>
    <done>
      <eval token="app_a">if($result.app$="app_a","App_A",null())</eval>
      <eval token="app_b">if($result.app$="app_b","App_B",null())</eval>
    </done>
  </search>

with the depends="$app_a/b$" in the appropriate panel definition

Hope this helps

Tags (1)

santosh_sshanbh
Path Finder

Thanks for the help. Your solution worked successfully and I also got to know that tokens are not available in Init part of dashboard.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...