Hello all,
This is my query to save the value of sipname to a token
`| rest /services/authentication/current-context `
`| where username!="splunk-system-user" `
`| fields realname,email`
`| eval sipname=lower(email) `
`| eval sipname=mvindex(split(sipname,"@"),0) `
`|table realname,sipname`
`<set token="sipname">$row.sipname$</set>`
However this doesn't work, in other dashboards when I use the token '$sipname$', I only see value as '$row.sipname$'
Does anyone have any suggestion? Thanks
Hello,
from your post, I understand you try to configure a drilldown.
Please find bellow an example of dashboard.
The change of the token value can be seen in the title of the table.
<dashboard>
<row>
<panel>
<table>
<title>$sometoken$</title>
<search>
<query>| rest /services/authentication/current-context
| where username!="splunk-system-user"
| fields realname,email
| eval sipname=lower(email)
| eval sipname=mvindex(split(sipname,"@"),0)
|table realname,sipname</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<eval token="sometoken">$row.sipname$</eval>
</drilldown>
</table>
</panel>
</row>
</dashboard>
Hello,
from your post, I understand you try to configure a drilldown.
Please find bellow an example of dashboard.
The change of the token value can be seen in the title of the table.
<dashboard>
<row>
<panel>
<table>
<title>$sometoken$</title>
<search>
<query>| rest /services/authentication/current-context
| where username!="splunk-system-user"
| fields realname,email
| eval sipname=lower(email)
| eval sipname=mvindex(split(sipname,"@"),0)
|table realname,sipname</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<eval token="sometoken">$row.sipname$</eval>
</drilldown>
</table>
</panel>
</row>
</dashboard>
sorry i wasn;t clear enough, i was trying to set the token after the query completed, via:
<done>
<condition match="'job.resultCount' > 0">
<set token="sipname">$row.sipname$</set>
</condition>
<done>
Means that the token will be set automatically, not by drill down action.
Then I think this is more what you need.
<dashboard>
<search>
<query>| rest /services/authentication/current-context
| where username!="splunk-system-user"
| fields realname,email
| eval sipname=lower(email)
| eval sipname=mvindex(split(sipname,"@"),0)
| head 1
|table realname,sipname</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<preview>
<eval token="sometoken">$result.sipname$</eval>
</preview>
</search>
<row>
<panel>
<table>
<title>$sometoken$</title>
<search>
<query>| rest /services/authentication/current-context
| where username!="splunk-system-user"
|table username</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</dashboard>
Please note that in this case, we use result.sipname, not row.sipname, and this may be the cause of your pb.
yes this helps to resolve my problem. Thank you very much!