Dashboards & Visualizations

Is there a different way to set a token in a form without using input fields like textbox or dropdown?

gokool2u
Explorer

Is there anyway to declare a token in a form without using input fields like textbox and dropdown?

Tags (2)
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@gokool2u - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

0 Karma

tonymata
Engager

gokool2u,

In Splunk 6.5 you can use the <init> element to set or update token values when a dashboard or form opens.

http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#init

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Set_tokens_on_page_load

Hope this helps.

MuS
Legend

Hi gokool2u,

Just had to solve exactly this problem :winking_face: Using Splunk 6.5.1 I created a form with a dropdown and was able to hide it using like this:

      <input type="dropdown" token="dm" searchWhenChanged="true" depends="$foobarbaz$">

This way I was still able to use it as a drill down target and provide the $dm$ token.
One thing, there is a link that says Show Filters and by clicking on this the dropdown will not appears again.

Hope this helps ...

cheers, MuS

0 Karma

MuS
Legend

Just found another nice option hideFilters="True"

0 Karma

sundareshr
Legend

You can create a dummy search component and set your token in there. Try something like this in your dashboard

  <search>
    <query>| makeresults</query>
    <progress>
      <set token="hw">hello world"</set>
    </progress>
  </search>

sharding8
New Member

This was actually a great solution to what I needed, which was stitch my token back together. Had a request to separate a single pull-down (Hadoop cluster reference) to two pull-downs (Hadoop env and Hadoop cluster name), but already had the single pull-down token in all searches.

Ended up with:

  <search>
     <query>|makeresults |eval a="$env$", b="$cluster_type$"</query>
     <progress>
       <set token="cluster">$form.env$-$form.cluster_type$</set>
     </progress>
   </search>

Worked like a charm and keeps the search from running until both tokens have a value.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...