Dashboards & Visualizations
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Referencing token value in Panel Title

kiddsupreme
Explorer
‎04-11-2018 02:36 PM

First, a quick look at my existing code:

<form>
  <label>Alert Status</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="errorcode_tok" searchWhenChanged="true">
      <label>KPI Selector</label>
      <default>%BGP-5-ADJCHANGE:</default>
      <choice value="%BGP-5-ADJCHANGE:">%BGP-5-ADJCHANGE:</choice>
      <choice value="%BGP_SESSION-5-ADJCHANGE:">%BGP_SESSION-5-ADJCHANGE:</choice>
      <choice value="%BGP-5-FLAP:">%BGP-5-FLAP:</choice>
      <choice value="%OSPF-5-ADJCHANGE:">%OSPF-5-ADJCHANGE: </choice>
      <choice value="%OSPF-5-ADJCHG:">%OSPF-5-ADJCHG:</choice>
      <choice value="%PM-4-ERR_DISABLE:">%PM-4-ERR_DISABLE:</choice>
      <choice value="%PM-SP-4-ERR_DISABLE:">%PM-SP-4-ERR_DISABLE:</choice>
      <choice value="%SPANTREE-2-ROOTGUARD_BLOCK:">%SPANTREE-2-ROOTGUARD_BLOCK:</choice>
      <choice value="%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD:">%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD::</choice>
      <choice value="%C6K_POWER-SP-1-PD_HW_FAULTY:">%C6K_POWER-SP-1-PD_HW_FAULTY:</choice>
    </input>
    <input type="time" token="TimeRangePkr" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-8h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Total Active BGP Events</title>
      <viz type="horseshoe_meter_app.horseshoe_meter">
        <search>
          <query>[search errorcode=$errorcode_tok$ dv_severity NOT "Clear" state=Processed | fields dv_number ] NOT [search errorcode=$errorcode_tok$ dv_severity="Clear" state=Closed | fields dv_number ]  | dedup dv_number | stats count(eval(dv_node)) as TOTAL</query>
          <earliest>rt</earliest>
          <latest>rt</latest>
          <sampleRatio>1</sampleRatio>
        </search>

Pretty straight forward, right? So why when I do this:

<title>$errorcode_tok$</title>

The title displays $errorcode_tok$ .... literally. Am I missing something on why it doesn't seem to be replacing the reference to the dropdown selection? Thanks in advance.

Reply
1 Solution
Solved! Jump to solution
Solution

niketn
Legend
‎04-12-2018 12:35 AM

@kiddsupreme, following works fine for me. Are you trying something else?

<form>
  <label>Token in Title</label>
   <fieldset submitButton="false" autoRun="true">
     <input type="dropdown" token="errorcode_tok" searchWhenChanged="true">
       <label>KPI Selector</label>
       <default>%BGP-5-ADJCHANGE:</default>
       <choice value="%BGP-5-ADJCHANGE:">%BGP-5-ADJCHANGE:</choice>
       <choice value="%BGP_SESSION-5-ADJCHANGE:">%BGP_SESSION-5-ADJCHANGE:</choice>
       <choice value="%BGP-5-FLAP:">%BGP-5-FLAP:</choice>
       <choice value="%OSPF-5-ADJCHANGE:">%OSPF-5-ADJCHANGE: </choice>
       <choice value="%OSPF-5-ADJCHG:">%OSPF-5-ADJCHG:</choice>
       <choice value="%PM-4-ERR_DISABLE:">%PM-4-ERR_DISABLE:</choice>
       <choice value="%PM-SP-4-ERR_DISABLE:">%PM-SP-4-ERR_DISABLE:</choice>
       <choice value="%SPANTREE-2-ROOTGUARD_BLOCK:">%SPANTREE-2-ROOTGUARD_BLOCK:</choice>
       <choice value="%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD:">%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD::</choice>
       <choice value="%C6K_POWER-SP-1-PD_HW_FAULTY:">%C6K_POWER-SP-1-PD_HW_FAULTY:</choice>
     </input>
     <input type="time" token="TimeRangePkr" searchWhenChanged="true">
       <label>Time Range</label>
       <default>
         <earliest>-8h</earliest>
         <latest>now</latest>
       </default>
     </input>
   </fieldset>
   <row>
    <panel>
      <title>$errorcode_tok$</title>
      <html></html>  
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Reply
Solved! Jump to solution
Solution

niketn
Legend
‎04-12-2018 12:35 AM

@kiddsupreme, following works fine for me. Are you trying something else?

<form>
  <label>Token in Title</label>
   <fieldset submitButton="false" autoRun="true">
     <input type="dropdown" token="errorcode_tok" searchWhenChanged="true">
       <label>KPI Selector</label>
       <default>%BGP-5-ADJCHANGE:</default>
       <choice value="%BGP-5-ADJCHANGE:">%BGP-5-ADJCHANGE:</choice>
       <choice value="%BGP_SESSION-5-ADJCHANGE:">%BGP_SESSION-5-ADJCHANGE:</choice>
       <choice value="%BGP-5-FLAP:">%BGP-5-FLAP:</choice>
       <choice value="%OSPF-5-ADJCHANGE:">%OSPF-5-ADJCHANGE: </choice>
       <choice value="%OSPF-5-ADJCHG:">%OSPF-5-ADJCHG:</choice>
       <choice value="%PM-4-ERR_DISABLE:">%PM-4-ERR_DISABLE:</choice>
       <choice value="%PM-SP-4-ERR_DISABLE:">%PM-SP-4-ERR_DISABLE:</choice>
       <choice value="%SPANTREE-2-ROOTGUARD_BLOCK:">%SPANTREE-2-ROOTGUARD_BLOCK:</choice>
       <choice value="%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD:">%C4K_IOSMODPORTMAN-4-POWERSUPPLYBAD::</choice>
       <choice value="%C6K_POWER-SP-1-PD_HW_FAULTY:">%C6K_POWER-SP-1-PD_HW_FAULTY:</choice>
     </input>
     <input type="time" token="TimeRangePkr" searchWhenChanged="true">
       <label>Time Range</label>
       <default>
         <earliest>-8h</earliest>
         <latest>now</latest>
       </default>
     </input>
   </fieldset>
   <row>
    <panel>
      <title>$errorcode_tok$</title>
      <html></html>  
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Reply
Solved! Jump to solution

kiddsupreme
Explorer
‎04-12-2018 11:14 AM

You have got to be kidding me. So when I was doing the editing, I would switch back and forth between UI and Source. When I would look, it would show the literal variable name. But when I clicked Save, all of the sudden it was showing properly. My apologies folks, I should have taken... one...more...step

Reply
Solved! Jump to solution

Vebloud
Explorer
‎03-20-2019 09:01 AM

You have just save me a lot of time trying to figure out what is wrong, simple save. Thanks

0 Karma
Reply
Solved! Jump to solution

seva98
Path Finder
‎02-11-2019 01:55 AM

@kiddsupreme Your comment needs to be in bold. Had exactly same problem, saving solved the issue. Thanks!

Reply
Solved! Jump to solution

niketn
Legend
‎04-12-2018 11:25 AM

@kiddsupreme, when you are in UI Edit mode, tokens will not be set. Now you know 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply
Solved! Jump to solution

p_gurav
Champion
‎04-11-2018 10:56 PM

One question, are you getting right value in search query errorcode=$errorcode_tok$ after selecting for dropdown?

0 Karma
Reply
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Take the Survey
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...