Dashboards & Visualizations

How to set tokens for different values on dashboard

Mary666
Communicator

Hi All,

I have a field with the following field with values:

Field_Values=case(Red="Low", 10, Blue="Medium", 28, Green="High", 14)

How can I create a token in the dashboard that will have these values? This token will not be used for a filter in the dashboard or a drilldown. I am not sure if there is a default token to assign this to. 

I am using the below code, but using job.resultCount is only giving me the highest value which is 3600 I need it to give me the corresponding Field_Value for when its Low, Medium or High..... any advise? 

  <condition match=" 'job.resultCount' &gt; 0">
        <set token="Field_Values">$result.Field_Values</set>
      </condition>

 

Labels (1)
0 Karma
1 Solution

Mary666
Communicator

 

<change>
<set token="Colors">$label$</set> 
</change>

instead of...

<change>
<set token="Colors">$result.tok_Numbers$</set>
</change>

I figured it out so since I was using the fieldForlabel as my token I used label and then it worked well, based on this previous question and answer...

https://community.splunk.com/t5/Dashboards-Visualizations/Pass-the-label-of-an-input-to-the-title-of...

 

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

The $result.Field_Values$ will taken the first result row.

I'm not sure I understand what you're trying to set Field_Values to, as you have 3 distinct conditions where you compare 3 different fields to a value and Field_Values to be the number 10, 28 or 14, however, you indicated that the token can get a value of 3600...

Can you give a clear example of what value a token should have based on the search you have?

 

0 Karma

Mary666
Communicator

So... tok_grade is in a drop down filter and has a query that includes the values like so... 10=low, 28=Medium, and 14= High

<input type="dropdown" searchWhenChanged="true" token="tok_Numbers">


I have a lookup called Colors.csv There it gives me each color: Red, Blue, Green  and it will show Red=High, Blue=Medium, Green=Low

<change><set token="Colors">$result. tok_Numbers$ </set> </change>

So what I would like is for me to select from the filter (low) and then see on the title of the panel what the low value stands for which is 10, but instead its just stuck with the medium value of 28. 

I am new with the token stuff.... If I didn't make much sense I would appreciate it if there was something you can send to me that may kind of help me understand tokens and how to pass their fields on a dashboard. 

0 Karma

Mary666
Communicator

 

<change>
<set token="Colors">$label$</set> 
</change>

instead of...

<change>
<set token="Colors">$result.tok_Numbers$</set>
</change>

I figured it out so since I was using the fieldForlabel as my token I used label and then it worked well, based on this previous question and answer...

https://community.splunk.com/t5/Dashboards-Visualizations/Pass-the-label-of-an-input-to-the-title-of...

 

 

bowesmana
SplunkTrust
SplunkTrust

Well done @Mary666 figuring it out.

Tokens are very powerful and also a little tricky to find a definitive place that unravels their secrets.

Yes, the <input> + <change> element can provide the $value$ and $label$ tokens, which represent the two parts of the dropdown.

Have a look at the token reference, as well as the Simple XML reference and event handler

https://docs.splunk.com/Documentation/Splunk/8.2.3/Viz/TokenReference

as that shows how you can structure your searches, so you can pretty much create any kind of token from a search that can then be used in a dashboard. For example, with this syntax

<table depends="$hidden_table$>
  <search>
    <query>
some query that generates a row of data
    </query>
    <done>
      <set token="some_result_field">$result.important_field$</set>
      <eval token="calc_info">if(isnull($result.optional$),"Empty",$result.optional$)</eval>
    </done>
  </search>   
</table>

You can have a table that is not shown in the dashboard, but which runs a search and creates two tokens, $some_result_field$ and $calc_info$ which will be set when the search finishes and those tokens can be used elsewhere in the dashboard.

You can get great power and produce some really neat dashboards using tokens, with panels that display and hide themselves (using depends="$token$" syntax) which allows you to make dashboards that react nicely to clicks.

 

Mary666
Communicator

Thanks for the reference and explanation, this is helpful

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...