@gokool2u - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.
In Splunk 6.5 you can use the
<init> element to set or update token values when a dashboard or form opens.
Hope this helps.
Just had to solve exactly this problem 😉 Using Splunk 6.5.1 I created a form with a dropdown and was able to hide it using like this:
<input type="dropdown" token="dm" searchWhenChanged="true" depends="$foobarbaz$">
This way I was still able to use it as a drill down target and provide the
One thing, there is a link that says
Show Filters and by clicking on this the dropdown will not appears again.
Hope this helps ...
You can create a dummy search component and set your token in there. Try something like this in your dashboard
<search> <query>| makeresults</query> <progress> <set token="hw">hello world"</set> </progress> </search>
This was actually a great solution to what I needed, which was stitch my token back together. Had a request to separate a single pull-down (Hadoop cluster reference) to two pull-downs (Hadoop env and Hadoop cluster name), but already had the single pull-down token in all searches.
Ended up with:
<search> <query>|makeresults |eval a="$env$", b="$cluster_type$"</query> <progress> <set token="cluster">$form.env$-$form.cluster_type$</set> </progress> </search>
Worked like a charm and keeps the search from running until both tokens have a value.