Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Persist token values across systems
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Persist token values across systems
Hi,
I have a dashboard which displays a static panel called "High Response Time".
Anyone in my team will manually fill in this panel with a name (say DB) to bring attention to any component that is very slow.
The dashboard is will be viewed from many individual systems. So, if I change the text fields to DB on my system, it comes up as blank or "NONE" on the other systems.
Is there any way to persist the token across systems, so that if I change the value of text field, anyone opening the dashboard on their system will see "DB" as well?
Please find the run-anywhere example below,
<form hideFilters="true">
<label>Test_Token_Persist</label>
<init>
<eval token="latest">(floor(now()/300))*300</eval>
<eval token="earliest">relative_time($latest$, "-15m")</eval>
<set token="highResponseTime">NONE</set>
</init>
<fieldset submitButton="false">
<input type="text" token="highResponseTime">
<label>High Response Time</label>
</input>
</fieldset>
<row>
<panel>
<html>
<h1>HIGH REPONSE TIME FOR: $highResponseTime$</h1>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>search * | eval count=1 | dedup count | table count</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
I have created a text field, assigned a token to it, and displayed the token value in the dashboard. Someone in my team will fill in the text field manually.
Thanks,
Deepak
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I understand you correctly, you desire to have the last set token value across the entire Search Head as the initial value for the next person visiting the dashboard. If so, you can set the initial value by using the REST API call to pull in recently run searches and leave something like | rename FieldThatDoesNotExist AS "some stupid text that you can search for" inside of your panel's search string. Pull in recent searches from the API, search for the last one that has this string, pull out the YourValue from the YourField=YourValue from the search string and use this to set the initial value of your field.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue might be , you are setting highResponseTime token twice. Try to change the token for anyone.
try this,
Test_Token_Persist
<eval token="latest">(floor(now()/300))*300</eval>
<eval token="earliest">relative_time($latest$, "-15m")</eval>
<set token="highResponseTime">NONE</set>
<input type="text" token="highResponseTime1">
<label>High Response Time</label>
<default>dba</default>
</input>
<panel>
<html>
<h1>HIGH REPONSE TIME FOR: $highResponseTime1$</h1>
</panel>
<panel>
<table>
<search>
<query>search * | eval count=1 | dedup count | table count</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thankyou.
But when I open this dashboard on a different laptop, it shows 'HIGH RESPONSE TIME FOR: NONE'. It must show 'HIGH RESPONSE TIME FOR: DB'.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
