Dashboards & Visualizations

How to set a conditional token in a Simple XML dashboard?

inetmiguel
Explorer

I have a drop-down input field that uses a token $office_token$ to set the default value. $office_token$ is received from another dashboard when doing a drilldown as part of the http request.

If the token is not received, the default is not present and the input panel stays disabled, I would like to be able to use this even if the token is not received, so I need set the token to some value if the value is not received in the request.

I tried a conditional statement to check if the token is null, but it did not work. Also tried a few other things, but will try to keep the question short.

Is there a way to do this in Simple SML?

D_1_2_NT

 <condition match="isnull(office_token)">
     <set token='office_token'>someValue</set>
 </condition>


<input type="dropdown" token="Office" searchWhenChanged="true">
  <search>
    <query>my query</query>
  </search>
  <fieldForLabel>some office field</fieldForLabel>
  <fieldForValue>some office  field</fieldForValue>
  <default>$office_token$</default>
</input>

[...]

0 Karma

sundareshr
Legend

You said you are getting the token value for office_token from a different dashboard. Try setting the token name for the dropdown on this dashboard to office_token instead of Office and the default to *, instead of $office_token$. When the page loads the querystring will have the value for $office_token$ and set that as the selected value, if none exists will default to *

0 Karma

inetmiguel
Explorer

It does what you say!, the dropdown is filled with the token when present and defaults to * if not.
Thank you so much, it helps a lot.

Still I would like to know if we are able to use the conditionals in the way I attempted to do.

0 Karma

sundareshr
Legend

I don't believe you can use token to set default values for a form element. If this answers your question, please do mark it answered for the community.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...