Dashboards & Visualizations

Is there a way to specify a default value for a token in a saved search?

fduchatelet
Engager

Hi,

I have a report with a parameter ($myspan$) used in a dashboard.

From the dashboard, it works perfectly when the panel is invoked by:
|savedsearch toto myspan="span=2m"

The problem is the the report itself cannot be used as it triggers an error:
Error in 'timechart' command: the specifier '$myspan$' is invalid ...

Which is perfectly correct in this context as the report is specified as:
.... timechart $myspan$ count by country

So, is there a way to specify a default value for this $myspan$ token so that the report is also usable independently of a dashboard ?

I already tried:

  • an eval macro:
    empty(1)
    if(""!="$param","$param","")

  • different forms of eval and/or subsearches

François

0 Karma
1 Solution

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

View solution in original post

0 Karma

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

0 Karma

fduchatelet
Engager

Hi DalJeanis,

It indeed worked :-), but as you said, it is really tied to the specific token and I never managed to implement a macro where the default value can be specified in a macro parameter.

But I solved the problem indirectly, by not using the parametrized report directly, but by building another one using also savedsearch and passing whatever I wanted as parameter value in that case.

Cheers,
François

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...