How to pass tokens from prebuilt panels to other panels in the same dashboard?

[cafissimo]

Hello,
I have created a simple XML dashboard, that is targeted by a drilldown, with an initial panel that sets a token with earliest and latest formatted according to locale.

This is the first part of the dashboard:

<dashboard>
  <label>Dettaglio</label>
  <row>
    <panel>
      <table depends="$neverdisplay$">
        <title>neverdisplay</title>
        <search>
          <query>| gentimes start=-1 
                 | addinfo
                 | eval sth=strftime(info_min_time,"%H:%M:%S")
                 | eval eth=strftime(info_max_time,"%H:%M:%S")
                 | eval std=strftime(info_min_time,"%d/%m/%Y")
                 | eval etd=strftime(info_max_time,"%d/%m/%Y")
                 | eval orarionice=" dalle " . sth . " del " . std . " alle " . eth . " del " . etd
                 | table orarionice</query>
          <earliest></earliest>
          <latest></latest>
          <finalized>
            <set token="orarioselezionato">$result.orarionice$</set>
          </finalized>
        </search>
      </table>
    </panel>
    <panel>
      <title>Drilldown $form.range$ ed eseguite $orarioselezionato$</title>

The token $orarioselezionato$ is shown right in the title of the second panel. For example:

Drilldown fino a 5m ed eseguite dalle 00:00:00 del 14/11/2016 alle 00:00:00 del 15/11/2016

Then after saving the initial panel as a prebuilt panel, the first part of the dashboard is:

<dashboard>
  <label>Dettaglio</label>
  <row>
    <panel ref="pb_orarionice" app="Audit"></panel>
    <panel>
      <title>Drilldown $form.range$ ed eseguite $orarioselezionato$</title>

The problem is that the token orarioselezionato is rendered this way:

Drilldown fino a 5m ed eseguite $orarioselezionato$

Please, does anybody know how can I pass tokens from prebuilt panels to other panels in the same dashboard?
Thanks in advance

[cafissimo · Accepted solution]

I have found out what the problem is.
In my prebuilt panel I do not have set tokens for time:

           <earliest></earliest>
           <latest></latest>

If I pass, from the main dashboard, custom tokens for time it works like a charm.
The change in prebuilt panel is really simple, for example:

           <earliest>$oraearliest$</earliest>
           <latest>$oralatest$</latest>

By the way, thanks again

[frobinson_splun]

Hi @cafissimo,
I have tested some similar dashboard source code to yours in my own Splunk instance. It looks like the token from the prebuilt panel should resolve once that panel's search completes. So you might see the token name $orarioselezionato$ at first when the dashboard loads, but that should get replaced with the token value. If that doesn't happen, then there might be some other issue going on.

You might also consider using "depends" or "rejects" to control panel rendering here, such that the second panel waits for the $orarioselezionato$ token to be set before rendering.

Hope this helps!

[cafissimo]

I am going to try depends or rejects, since the token value is not displayed even at the end of the second panel search.

[frobinson_splun]

Thanks for your reply. I also wanted to point out that I just noticed this in your original Simple XML for the panel that you converted to prebuilt:
" table depends="$neverdisplay$"

Is it possible that this token dependency is causing the other token not to get a value? It sounds like your prebuilt panel does render in the dashboard, but I wonder if adjusting the table "depends" statement would change anything about the $orarioselezionato$ token value you need.