Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to use a custom token filter within Simple XML
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to implement a custom token filter based on the Transform and validate tokens docs, but can't quite seem to make it work.
Targeting Splunk 6.3-6.5. Testing on 6.5.0.
Broken Example
Javascript $SPLUNK_HOME/etc/apps/search/appserver/static/lowell_filter.js:
require([
"splunkjs/mvc",
], function(mvc) {
mvc.setFilter("testFilter", function(inputValue) {
return "It worked " + inputValue;
});
}
Example Dashboard:
<dashboard script="lowell_filter.js">
<label>token_test</label>
<row>
<panel>
<table>
<search>
<query>index=_internal sourcetype=splunkd | cluster showcount=true | table _time, log_level, component, message, cluster_count | sort - cluster_count</query>
<earliest>-1h@m</earliest>
<latest>@m</latest>
</search>
<option name="drilldown">row</option>
<drilldown>
<set token="message">$row.message$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<html depends="$message$">
<h1>Message</h1>
Filter s: $message|s$ <br/>
Filter s+u: $message|s|u$ <br/>
Filter testFilter: $message|testFilter$ <br/>
</html>
</row>
</dashboard>
When I click on a row, the s and s+u filters show what I would expected, but the last line shows the literal value, still surrounded in dollar marks.
Filter testFilter: $message|testFilter$
Update:
I've determined that if I run the following code interactively from my browser's Javascript console, that the filter is called as expected.
window.splunkjs.mvc.setFilter("testFilter", function(inputValue) {
return "It worked " + inputValue;
});
If I click on the table, triggering the drilldown action, then it adds the "It worked" prefix onto the token value. I think this validates that I'm calling the right function, and the desired functionality is present, just that I have something wrong in how/where I'm calling setFilter().
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Add the missing the closing parenthesis to your JS file
require([
"splunkjs/mvc",
], function(mvc) {
mvc.setFilter("testFilter", function(inputValue) {
return "It worked " + inputValue;
});
});
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Add the missing the closing parenthesis to your JS file
require([
"splunkjs/mvc",
], function(mvc) {
mvc.setFilter("testFilter", function(inputValue) {
return "It worked " + inputValue;
});
});
Accelerating Observability as Code with the Splunk AI Assistant
Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...
Congratulations to the 2025-2026 SplunkTrust!
