Dashboards & Visualizations

Is there a different way to set a token in a form without using input fields like textbox or dropdown?

gokool2u
Explorer

Is there anyway to declare a token in a form without using input fields like textbox and dropdown?

Tags (2)
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@gokool2u - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

0 Karma

tonymata
Engager

gokool2u,

In Splunk 6.5 you can use the <init> element to set or update token values when a dashboard or form opens.

http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#init

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Set_tokens_on_page_load

Hope this helps.

MuS
SplunkTrust
SplunkTrust

Hi gokool2u,

Just had to solve exactly this problem 😉 Using Splunk 6.5.1 I created a form with a dropdown and was able to hide it using like this:

      <input type="dropdown" token="dm" searchWhenChanged="true" depends="$foobarbaz$">

This way I was still able to use it as a drill down target and provide the $dm$ token.
One thing, there is a link that says Show Filters and by clicking on this the dropdown will not appears again.

Hope this helps ...

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Just found another nice option hideFilters="True"

0 Karma

sundareshr
Legend

You can create a dummy search component and set your token in there. Try something like this in your dashboard

  <search>
    <query>| makeresults</query>
    <progress>
      <set token="hw">hello world"</set>
    </progress>
  </search>
0 Karma

sharding8
New Member

This was actually a great solution to what I needed, which was stitch my token back together. Had a request to separate a single pull-down (Hadoop cluster reference) to two pull-downs (Hadoop env and Hadoop cluster name), but already had the single pull-down token in all searches.

Ended up with:

  <search>
     <query>|makeresults |eval a="$env$", b="$cluster_type$"</query>
     <progress>
       <set token="cluster">$form.env$-$form.cluster_type$</set>
     </progress>
   </search>

Worked like a charm and keeps the search from running until both tokens have a value.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...