Dashboards & Visualizations

How to use tokens to set values for fields in reports on a dashboard

masonwhite
Explorer

I have a series of reports that measure different statistics on network traffic, saved to a single dashboard. I want to have a text input that allows me to specify a subnet. I can get the query to run properly when i have the actual search inline with the dashboard but when referencing the report its like the token value is not getting passed to the report. I am thinking this is due to the dashboard pulling the report and so the report isnt getting passed any dashboard variables as the dashboard is only "ref" the report?

I can upload my xml if need be but i feel this is a simple yes or no capability question.

Tags (1)
0 Karma

masonwhite
Explorer

Token Set XML

    <input type="text" token="client_subnet">
      <label>client_subnet</label>
      <default>*</default>
    </input>
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

Inline search that works and is also the same code saved as a report

<search>
          <query>index=my_index sourcetype=my_sourcetype dst=$client_subnet$ 
| top limit=5 src 
| iplocation src 
| eval percent=round(percent,2) 
| rename percent as Inbound Country as "Inbound Country" 
| appendcols 
    [ search index=my_index sourcetype=my_sourcetype src=$client_subnet$ 
    | top limit=5 dst 
    | iplocation dst 
    | eval percent=round(percent,2) 
    | rename percent as Outbound Country as "Outbound Country"] 
| table Inbound "Inbound Country" Outbound "Outbound Country" 
| fieldformat Inbound="%".Inbound 
| fieldformat Outbound="%".Outbound</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>

Saved report being referenced on the dashboard that does not work with token

  <panel>
      <table>
        <title>Top 5 Directional Traffic by Country</title>
        <search ref="Top 5 Directional Traffic by Country"></search>
        <option name="drilldown">none</option>
      </table>
    </panel>
0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...