Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How to use other values if the token is undefi...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a dashboard that can be access two way. first is from a drill down from another dashboard and other is accessing directly the dashboard link.
What I want to do is use $timestamp$ when access through drill down and when access using the link where as $timestamp$ is not defined use the date today for my datepicker.
Here is what I did so far but not working because the search will not run when $timestamp$ is not existing.
<search>
<query> | makeresults
| eval fromDilldown = "$timestamp$"
| eval defaultDateToday=strftime(relative_time(now(),"-1d@d"),"%Y-%m-%d")
| eval myDate = if(fromDilldown="",defaultDateToday,fromDilldown)
</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<done>
<set token="timestampA">$value.myDate$</set>
</done>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@michaelrosello try the following run anywhere example which mimics scenario where timestamp is not set.
For testing the scenario where timestamp is set in your source dashboard, you can un-comment the <init> section and set specific value as per your need.
It uses <eval> tag in an independent <search> event handler to evaluate whether input token i.e. $timestamp$ in this case is null or not and then sets the token i.e. $timestampA$ in the dashboard (destination) accordingly.
<dashboard>
<label>Use Deafult Token if Provided Token is Null</label>
<!-- UNCOMMENT init section to default timestamp to some value.
For testing drilldown with timestamp value set-->
<!--
<init>
<set token="timestamp">-7d@d</set>
</init>
-->
<search>
<query> | makeresults
</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<done>
<eval token="timestampA">case(isnull($timestamp$),relative_time(now(),"-1d@d"),true(),$timestamp$)</eval>
</done>
</search>
<!-- HTML Panel to display the tokens for testing i.e. $timestamp$ from source dashboard and $timestampA$ set in destination dashboard. -->
<row>
<panel>
<html>
<div>timestamp: $timestamp$</div>
<div>timestampA: $timestampA$</div>
</html>
</panel>
</row>
</dashboard>
Please try out and confirm!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@michaelrosello try the following run anywhere example which mimics scenario where timestamp is not set.
For testing the scenario where timestamp is set in your source dashboard, you can un-comment the <init> section and set specific value as per your need.
It uses <eval> tag in an independent <search> event handler to evaluate whether input token i.e. $timestamp$ in this case is null or not and then sets the token i.e. $timestampA$ in the dashboard (destination) accordingly.
<dashboard>
<label>Use Deafult Token if Provided Token is Null</label>
<!-- UNCOMMENT init section to default timestamp to some value.
For testing drilldown with timestamp value set-->
<!--
<init>
<set token="timestamp">-7d@d</set>
</init>
-->
<search>
<query> | makeresults
</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<done>
<eval token="timestampA">case(isnull($timestamp$),relative_time(now(),"-1d@d"),true(),$timestamp$)</eval>
</done>
</search>
<!-- HTML Panel to display the tokens for testing i.e. $timestamp$ from source dashboard and $timestampA$ set in destination dashboard. -->
<row>
<panel>
<html>
<div>timestamp: $timestamp$</div>
<div>timestampA: $timestampA$</div>
</html>
</panel>
</row>
</dashboard>
Please try out and confirm!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @niketnilay as always!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could probably use coalesce for this. It takes a number of values and returns the first non-null one.
... | eval fromDilldown = coalesce($timestamp$,"some other value")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've already tried this also. but same result, the search wont run because of undefined token.
Index This | What is broken 80% of the time by February?
Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...
Splunk MCP & Agentic AI: Machine Data Without Limits
