Dashboards & Visualizations

How to obtain token value from token with suffix?


Hopefully I can explain this so it's not too confusing and I'm not overcomplicating things....  I'm currently setting a token based on a particular click value, which is used to drive other charts in the dashboard.  I'm looking to expand upon that and lookup a second token based on that token by appending something like _IntValue to the token name.

Here's an example:

1) I first set static token int values in the dashboard based on what values will appear as in the first chart.  The first chart will have click values of "Sample Click" and "Sample 2 Click".  I want to manually say that the IntValues for those are 20 and 60.

<set token="Sample Click Value_IntValue">20</set>
<set token="Sample 2 Click Value_IntValue">60</set>

2) When I click on the dashboard and the value is "Sample Click", I want to be able to use "Sample Click_IntValue" as a token in another chart.  

The real-life scenario is certain click values will already be calculating total initiations over a period of time.  Each one of those initiations takes X hours to complete.  I want to detail how one particular task that takes 20 hours each attempt that was run 20 times over a period of time equates to 400 hours over that period of time.  And when another task is clicked that takes 60 hours to complete and was run 10 times over a period of time equates to 600 hours.

Thanks in advance!!!!


Labels (2)
0 Karma


In your drilldown for the first chart, use <eval> for the tokens so that you can use an if or case function to set the value of the token based on the click value.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...