Dashboards & Visualizations

Is there a way to specify a default value for a token in a saved search?

fduchatelet
Engager

Hi,

I have a report with a parameter ($myspan$) used in a dashboard.

From the dashboard, it works perfectly when the panel is invoked by:
|savedsearch toto myspan="span=2m"

The problem is the the report itself cannot be used as it triggers an error:
Error in 'timechart' command: the specifier '$myspan$' is invalid ...

Which is perfectly correct in this context as the report is specified as:
.... timechart $myspan$ count by country

So, is there a way to specify a default value for this $myspan$ token so that the report is also usable independently of a dashboard ?

I already tried:

  • an eval macro:
    empty(1)
    if(""!="$param","$param","")

  • different forms of eval and/or subsearches

François

0 Karma
1 Solution

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

View solution in original post

0 Karma

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

0 Karma

fduchatelet
Engager

Hi DalJeanis,

It indeed worked :-), but as you said, it is really tied to the specific token and I never managed to implement a macro where the default value can be specified in a macro parameter.

But I solved the problem indirectly, by not using the parametrized report directly, but by building another one using also savedsearch and passing whatever I wanted as parameter value in that case.

Cheers,
François

Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...