Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to use other values if the token is undefined ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a dashboard that can be access two way. first is from a drill down from another dashboard and other is accessing directly the dashboard link.
What I want to do is use $timestamp$ when access through drill down and when access using the link where as $timestamp$ is not defined use the date today for my datepicker.
Here is what I did so far but not working because the search will not run when $timestamp$ is not existing.
<search>
<query> | makeresults
| eval fromDilldown = "$timestamp$"
| eval defaultDateToday=strftime(relative_time(now(),"-1d@d"),"%Y-%m-%d")
| eval myDate = if(fromDilldown="",defaultDateToday,fromDilldown)
</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<done>
<set token="timestampA">$value.myDate$</set>
</done>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@michaelrosello try the following run anywhere example which mimics scenario where timestamp is not set.
For testing the scenario where timestamp is set in your source dashboard, you can un-comment the <init> section and set specific value as per your need.
It uses <eval> tag in an independent <search> event handler to evaluate whether input token i.e. $timestamp$ in this case is null or not and then sets the token i.e. $timestampA$ in the dashboard (destination) accordingly.
<dashboard>
<label>Use Deafult Token if Provided Token is Null</label>
<!-- UNCOMMENT init section to default timestamp to some value.
For testing drilldown with timestamp value set-->
<!--
<init>
<set token="timestamp">-7d@d</set>
</init>
-->
<search>
<query> | makeresults
</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<done>
<eval token="timestampA">case(isnull($timestamp$),relative_time(now(),"-1d@d"),true(),$timestamp$)</eval>
</done>
</search>
<!-- HTML Panel to display the tokens for testing i.e. $timestamp$ from source dashboard and $timestampA$ set in destination dashboard. -->
<row>
<panel>
<html>
<div>timestamp: $timestamp$</div>
<div>timestampA: $timestampA$</div>
</html>
</panel>
</row>
</dashboard>
Please try out and confirm!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@michaelrosello try the following run anywhere example which mimics scenario where timestamp is not set.
For testing the scenario where timestamp is set in your source dashboard, you can un-comment the <init> section and set specific value as per your need.
It uses <eval> tag in an independent <search> event handler to evaluate whether input token i.e. $timestamp$ in this case is null or not and then sets the token i.e. $timestampA$ in the dashboard (destination) accordingly.
<dashboard>
<label>Use Deafult Token if Provided Token is Null</label>
<!-- UNCOMMENT init section to default timestamp to some value.
For testing drilldown with timestamp value set-->
<!--
<init>
<set token="timestamp">-7d@d</set>
</init>
-->
<search>
<query> | makeresults
</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<done>
<eval token="timestampA">case(isnull($timestamp$),relative_time(now(),"-1d@d"),true(),$timestamp$)</eval>
</done>
</search>
<!-- HTML Panel to display the tokens for testing i.e. $timestamp$ from source dashboard and $timestampA$ set in destination dashboard. -->
<row>
<panel>
<html>
<div>timestamp: $timestamp$</div>
<div>timestampA: $timestampA$</div>
</html>
</panel>
</row>
</dashboard>
Please try out and confirm!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @niketnilay as always!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could probably use coalesce for this. It takes a number of values and returns the first non-null one.
... | eval fromDilldown = coalesce($timestamp$,"some other value")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've already tried this also. but same result, the search wont run because of undefined token.
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Feel the Splunk Love: Real Stories from Real Customers
Data Management Digest – November 2025
