Dashboards & Visualizations

How to eval a token in the Init part of dashboard based on another token

santosh_sshanbh
Path Finder

I have 2 custom apps as App_A and App_B. I want to hide a panel based on the current app. For that I have used $env:app$ token. 

Now I want to eval a new token in the Init part of the dashboard which will compare the $env:app$ with App_A or App_B and then generate the value for new token.

I tried various options like case, if but no success. Can any one help me in this scenario?

 

 

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I don't think tokens are available at the init phase, so you can do it using a search and a done clause

  <search>
    <query>
      |makeresults
      | eval app="$env:app$"
    </query>
    <done>
      <eval token="app_a">if($result.app$="app_a","App_A",null())</eval>
      <eval token="app_b">if($result.app$="app_b","App_B",null())</eval>
    </done>
  </search>

with the depends="$app_a/b$" in the appropriate panel definition

Hope this helps

View solution in original post

Tags (1)

bowesmana
SplunkTrust
SplunkTrust

I don't think tokens are available at the init phase, so you can do it using a search and a done clause

  <search>
    <query>
      |makeresults
      | eval app="$env:app$"
    </query>
    <done>
      <eval token="app_a">if($result.app$="app_a","App_A",null())</eval>
      <eval token="app_b">if($result.app$="app_b","App_B",null())</eval>
    </done>
  </search>

with the depends="$app_a/b$" in the appropriate panel definition

Hope this helps

Tags (1)

santosh_sshanbh
Path Finder

Thanks for the help. Your solution worked successfully and I also got to know that tokens are not available in Init part of dashboard.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...