Dashboards & Visualizations

Is there a way to specify a default value for a token in a saved search?

fduchatelet
Engager

Hi,

I have a report with a parameter ($myspan$) used in a dashboard.

From the dashboard, it works perfectly when the panel is invoked by:
|savedsearch toto myspan="span=2m"

The problem is the the report itself cannot be used as it triggers an error:
Error in 'timechart' command: the specifier '$myspan$' is invalid ...

Which is perfectly correct in this context as the report is specified as:
.... timechart $myspan$ count by country

So, is there a way to specify a default value for this $myspan$ token so that the report is also usable independently of a dashboard ?

I already tried:

  • an eval macro:
    empty(1)
    if(""!="$param","$param","")

  • different forms of eval and/or subsearches

François

0 Karma
1 Solution

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

View solution in original post

0 Karma

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

0 Karma

fduchatelet
Engager

Hi DalJeanis,

It indeed worked :-), but as you said, it is really tied to the specific token and I never managed to implement a macro where the default value can be specified in a macro parameter.

But I solved the problem indirectly, by not using the parametrized report directly, but by building another one using also savedsearch and passing whatever I wanted as parameter value in that case.

Cheers,
François

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...