Initialize Token As Default Values Then Insert Latest Values When New Values Received

[qygoh]

Hi guys i currently facing an issues need to default token as default values let said 'zero' when there is no values received. However it will change when new values are received. I no sure which part of of code went wrong. I can't event put a condition for default it. Mind to share? Below is my code:

Hi guys, currently i facing an issues which need initialize my token as any value 1st. However the token values will change when a new values received. Below is my code:

<search id="header">
<query>index="rtindex" Label="CH1" Order="12" |eval Value=round(Value,3) |stats latest(Value) as Value by ID2 |rename ID2 as Label | untable Label field name | xyseries field Label name</query>
<earliest>@d</earliest>
<latest>now</latest>
<preview>
  <set token="FLOW_LPS">$result.CH1_CHW_FLOW_LPS$</set>
  <set token="FLOW">$result.CH1_CHW_FLOW$</set>
  <set token="COOLING_LOAD">$result.CH1_COOLING_LOAD$</set>
  <set token="EFF">$result.CH1_EFF$</set>
</preview>


<table id="Chiller_1" border="1px solid black"> 
      <tr><th>HEADER Details </th><th>Values</th></tr>
       <tr><td>CHWF (USGPM)</td><td>$CH1_CHW_FLOW$</td></tr> 
       <tr><td>FLOW (LPS)</td><td>$CH1_CHW_FLOW_LPS$</td></tr>
       <tr><td>COOLING LOAD</td><td>$CH1_COOLING_LOAD$</td></tr>  
       <tr><td>KW/Ton</td><td>$CH1_EFF$</td></tr> 
 </table>  

[niketn · Accepted solution]

If you are on Splunk 6.5 there is new init section to initialize tokens for the first time.

<form>
  <label>Application Monitoring: Exchange</label>
  <init>
    <set token="app_name">my_app_name</set>
  </init>
  <row>
    <panel>

Refer to the documentation below: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Set_tokens_on_page_load

However, your actual requirement is not to initialize token rather to default token when the value is not present. You can use eval for setting such tokens. using result.<Yourfieldname> you can access only one or rather first value of the field name. In other words result will be useful only when your query returns only single row of results.
As per your code

 <preview>
   <eval token="FLOW_LPS">if(isnull($result.CH1_CHW_FLOW_LPS$),0,$result.CH1_CHW_FLOW_LPS$)</eval>
   ...
   ...<renaminig eval statements similar to above>...
   ....
 </preview>

[qygoh]

It work perfectly!!! Thank you very much for your help. At 1st i try using:

 <set token="app_name">my_app_name</set>

It give me error message and i not sure why. After i check it and i realize my splunk version is 6.4. You save my day bro. Thank you.

[fk319]

there is a pre-defined environment variable so you do not ahve to hard code.
$env:app$
http://docs.splunk.com/Documentation/Splunk/7.2.1/Viz/tokens#Use_global_tokens_to_access_environment...

[niketn]

@qygoh Anytime... glad it worked!!!

[woodcock]

It will really help to explain how things should work when users do certain things on your form.

[qygoh]

This is a page to display all the values when user navigate to this page. However there are certain fields without any value and it will showed $CH1_COOLING_LOAD$. i wish to default it as zero for those field without values. Did you have any idea how should i handle it? Thank you very much.