Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to reference token namespaces in SimpleXML?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I recently saw a reference in slides from .conf 2016 (https://conf.splunk.com/files/2016/slides/dashboard-wizardry.pdf, slide 16) that suggests one can reference a specific token namespace in SimpleXML, e.g., $submitted:mytoken$ or $default:mytoken$.
Initial searches for documentation came up empty, and simple tests in 6.4 seem to fail.
Can anyone clarify if this is supported, what versions support it, and if there is some documentation?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My own testing has determined the following:
- There currently is no documentation on the Splunk site and the Splunk Docs team has my feedback.
- This is only in Splunk 6.5 and newer
- You can reference the namespaces,
$default:...$and$submitted:..., to get token values. - You cannot reference the namespace when setting a token.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My own testing has determined the following:
- There currently is no documentation on the Splunk site and the Splunk Docs team has my feedback.
- This is only in Splunk 6.5 and newer
- You can reference the namespaces,
$default:...$and$submitted:..., to get token values. - You cannot reference the namespace when setting a token.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Note sure where in the other docs it might be, but here's a couple of references...
Walkthrough of the autogenerated HTML dashboard code:
http://dev.splunk.com/view/SP-CAAAETK#section4
Thread with a couple of good references...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for digging, but these are not applicable. I am very comfortable with token namepscaes in JS and HTML and their general underpinnings. The question is specifically about referencing tokens by their namespace in SimpleXML, which seems to be a feature with no documentation or clarification in terms of where it can be used.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I highly recommend installing Splunk 6.x Dashboard Examples app which has many good examples with sample codes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I do not see anything in that app or in the documentation that addresses my original question. If you can, please be more specific in regards to what I am missing that addresses my specific question about referencing the token namespaces directly in the SimpleXML token values, e.g., $submittied:mytoken$. Please point it out if I am missing something.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
How to find the worst searches in your Splunk environment and how to fix them
Share Your Feedback: On Admin Config Service (ACS)!
Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon
