I am trying to use less static colors as possible in a dashboard so that users could switch between dark and light mode without dashboard looking odd.
It would useful to have current theme in a token so that I could switch static colors based on chosen theme.
Too bad it is not in the env: tokens.
It is possible by parsing view data using a background search:
<query>| rest splunk_server="local" /servicesNS/-/-/data/ui/views search="eai:acl.app=<app_name> label=<view_label>"
| rex field="eai:data" "theme\=\"(?<theme>.+?)\""
| stats values(theme) as theme</query>
View solution in original post