Dashboards & Visualizations

Initialize Token As Default Values Then Insert Latest Values When New Values Received

qygoh
Engager

Hi guys i currently facing an issues need to default token as default values let said 'zero' when there is no values received. However it will change when new values are received. I no sure which part of of code went wrong. I can't event put a condition for default it. Mind to share? Below is my code:

Hi guys, currently i facing an issues which need initialize my token as any value 1st. However the token values will change when a new values received. Below is my code:

<search id="header">
<query>index="rtindex" Label="CH1" Order="12" |eval Value=round(Value,3) |stats latest(Value) as Value by ID2 |rename ID2 as Label | untable Label field name | xyseries field Label name</query>
<earliest>@d</earliest>
<latest>now</latest>
<preview>
  <set token="FLOW_LPS">$result.CH1_CHW_FLOW_LPS$</set>
  <set token="FLOW">$result.CH1_CHW_FLOW$</set>
  <set token="COOLING_LOAD">$result.CH1_COOLING_LOAD$</set>
  <set token="EFF">$result.CH1_EFF$</set>
</preview>


<table id="Chiller_1" border="1px solid black"> 
      <tr><th>HEADER Details </th><th>Values</th></tr>
       <tr><td>CHWF (USGPM)</td><td>$CH1_CHW_FLOW$</td></tr> 
       <tr><td>FLOW (LPS)</td><td>$CH1_CHW_FLOW_LPS$</td></tr>
       <tr><td>COOLING LOAD</td><td>$CH1_COOLING_LOAD$</td></tr>  
       <tr><td>KW/Ton</td><td>$CH1_EFF$</td></tr> 
 </table>  
0 Karma
1 Solution

niketn
Legend

If you are on Splunk 6.5 there is new init section to initialize tokens for the first time.

<form>
  <label>Application Monitoring: Exchange</label>
  <init>
    <set token="app_name">my_app_name</set>
  </init>
  <row>
    <panel>

Refer to the documentation below: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Set_tokens_on_page_load

However, your actual requirement is not to initialize token rather to default token when the value is not present. You can use eval for setting such tokens. using result.<Yourfieldname> you can access only one or rather first value of the field name. In other words result will be useful only when your query returns only single row of results.
As per your code

 <preview>
   <eval token="FLOW_LPS">if(isnull($result.CH1_CHW_FLOW_LPS$),0,$result.CH1_CHW_FLOW_LPS$)</eval>
   ...
   ...<renaminig eval statements similar to above>...
   ....
 </preview>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

If you are on Splunk 6.5 there is new init section to initialize tokens for the first time.

<form>
  <label>Application Monitoring: Exchange</label>
  <init>
    <set token="app_name">my_app_name</set>
  </init>
  <row>
    <panel>

Refer to the documentation below: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Set_tokens_on_page_load

However, your actual requirement is not to initialize token rather to default token when the value is not present. You can use eval for setting such tokens. using result.<Yourfieldname> you can access only one or rather first value of the field name. In other words result will be useful only when your query returns only single row of results.
As per your code

 <preview>
   <eval token="FLOW_LPS">if(isnull($result.CH1_CHW_FLOW_LPS$),0,$result.CH1_CHW_FLOW_LPS$)</eval>
   ...
   ...<renaminig eval statements similar to above>...
   ....
 </preview>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

qygoh
Engager

It work perfectly!!! Thank you very much for your help. At 1st i try using:

 <set token="app_name">my_app_name</set>

It give me error message and i not sure why. After i check it and i realize my splunk version is 6.4. You save my day bro. Thank you.

0 Karma

fk319
Builder

there is a pre-defined environment variable so you do not ahve to hard code.
$env:app$
http://docs.splunk.com/Documentation/Splunk/7.2.1/Viz/tokens#Use_global_tokens_to_access_environment...

niketn
Legend

@qygoh Anytime... glad it worked!!!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

It will really help to explain how things should work when users do certain things on your form.

0 Karma

qygoh
Engager

This is a page to display all the values when user navigate to this page. However there are certain fields without any value and it will showed $CH1_COOLING_LOAD$. i wish to default it as zero for those field without values. Did you have any idea how should i handle it? Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...