Dashboards & Visualizations

Passing a token via text input on Dashboard.

rwb18
Engager

I'm sure this is a simple fix, but I have been a little stuck. I'm trying to take just a text input and use that populate the corresponding dashboard.  I have the input panel added and a simple dashboard added, but the searches are not completing, even though I know it is a valid search.  Any help is appreciated. 

 

<input type="text" token="$Name_tok$" searchWhenChanged="true">
<label>Enter Text</label>
<default>*</default>
</input>
</row>
</default>
</input>
<input type="text" token="Name_tok">
<label> Name</label>
<default></default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=prod_devices Name=$Name_tok$ | table date, Name, version | dedup Name</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You seem to have 2 input boxes, one with 'Enter text' and the other with 'Name'.  Not sure what you are trying to do with 2 boxes, however, if you are looking for the user to enter a device name to search for, then remove the first <input> block and set the default/and/or the initial value of the Name input to *

You cannot use the $ sign in the token name as you have done in the first input as that means you are trying to define a token called $Name_tok$ which is not valid.

You also seem to have some illegal XML tags in wrong places, e.g. closing </row> and </fieldset> and </default> hanging in the middle of things.

This fragment should work. Note that I added |s in the use of the token, which causes it to be quoted, so in case spaces are types in the text, the search command will still work.

 

<fieldset>
  <input type="text" token="Name_tok">
    <label> Name</label>
    <default></default>
  </input>
</fieldset>
<row>
  <panel>
    <table>
      <search>
        <query>index=prod_devices Name=$Name_tok|s$ 
  | table date, Name, version 
  | dedup Name
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <option name="drilldown">none</option>
      <option name="refresh.display">progressbar</option>
    </table>
  </panel>
</row>

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

You seem to have 2 input boxes, one with 'Enter text' and the other with 'Name'.  Not sure what you are trying to do with 2 boxes, however, if you are looking for the user to enter a device name to search for, then remove the first <input> block and set the default/and/or the initial value of the Name input to *

You cannot use the $ sign in the token name as you have done in the first input as that means you are trying to define a token called $Name_tok$ which is not valid.

You also seem to have some illegal XML tags in wrong places, e.g. closing </row> and </fieldset> and </default> hanging in the middle of things.

This fragment should work. Note that I added |s in the use of the token, which causes it to be quoted, so in case spaces are types in the text, the search command will still work.

 

<fieldset>
  <input type="text" token="Name_tok">
    <label> Name</label>
    <default></default>
  </input>
</fieldset>
<row>
  <panel>
    <table>
      <search>
        <query>index=prod_devices Name=$Name_tok|s$ 
  | table date, Name, version 
  | dedup Name
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <option name="drilldown">none</option>
      <option name="refresh.display">progressbar</option>
    </table>
  </panel>
</row>

 

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...