Dashboards & Visualizations

SplunkJS/HTML Dashboards + map command + $foo$ substitution

alacercogitatus
SplunkTrust
SplunkTrust

So I'm trying to have a map command within a Simple XML dashboard. However, tokens work differently, causing my panel that has the map command to not display any information, and fails with "Waiting for Input".

Example:

<panel><table><search base="some_preproccesed_search"><query>map [ search $field_from_base_search$]</query></search></table></panel>

But since $field_from_base_search$ doesn't exist as a token in the dashboard, it sits and waits for input! Oh My! Whatever shall I do!?

(original question here: https://answers.splunk.com/answers/119666/splunkjs-html-dashboards-map-command-foo-substitution.html)

1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Well, Me, I'll tell you! New in Splunk 6.5, you can set tokens on dashboard initialization. Why is this important? Because you can set a token with the string of the token in the search! Is it pretty? Nope. Does it work? Yep!

Add this to the beginning of the dashboard:

<init><set token="map_token"><![CDATA[$field_from_base_search$]]></set></init>

NOTE: You need the CDATA in order to state that this is a "string" as far as dashboard tokens go.

And now your panel becomes:

<panel><table><search base="some_preproccesed_search"><query>map [ search $map_token$]</query></search></table></panel>

In effect, this allows the dashboard to set the token to a string, that then gets replaced when the search is executed!

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Set_tokens_on_page_load

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Well, Me, I'll tell you! New in Splunk 6.5, you can set tokens on dashboard initialization. Why is this important? Because you can set a token with the string of the token in the search! Is it pretty? Nope. Does it work? Yep!

Add this to the beginning of the dashboard:

<init><set token="map_token"><![CDATA[$field_from_base_search$]]></set></init>

NOTE: You need the CDATA in order to state that this is a "string" as far as dashboard tokens go.

And now your panel becomes:

<panel><table><search base="some_preproccesed_search"><query>map [ search $map_token$]</query></search></table></panel>

In effect, this allows the dashboard to set the token to a string, that then gets replaced when the search is executed!

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Set_tokens_on_page_load

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!