Dashboards & Visualizations

SplunkJS/HTML Dashboards + map command + $foo$ substitution

SplunkTrust
SplunkTrust

So I'm trying to have a map command within a Simple XML dashboard. However, tokens work differently, causing my panel that has the map command to not display any information, and fails with "Waiting for Input".

Example:

<panel><table><search base="some_preproccesed_search"><query>map [ search $field_from_base_search$]</query></search></table></panel>

But since $field_from_base_search$ doesn't exist as a token in the dashboard, it sits and waits for input! Oh My! Whatever shall I do!?

(original question here: https://answers.splunk.com/answers/119666/splunkjs-html-dashboards-map-command-foo-substitution.html)

1 Solution

SplunkTrust
SplunkTrust

Well, Me, I'll tell you! New in Splunk 6.5, you can set tokens on dashboard initialization. Why is this important? Because you can set a token with the string of the token in the search! Is it pretty? Nope. Does it work? Yep!

Add this to the beginning of the dashboard:

<init><set token="map_token"><![CDATA[$field_from_base_search$]]></set></init>

NOTE: You need the CDATA in order to state that this is a "string" as far as dashboard tokens go.

And now your panel becomes:

<panel><table><search base="some_preproccesed_search"><query>map [ search $map_token$]</query></search></table></panel>

In effect, this allows the dashboard to set the token to a string, that then gets replaced when the search is executed!

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Set_tokens_on_page_load

View solution in original post

SplunkTrust
SplunkTrust

Well, Me, I'll tell you! New in Splunk 6.5, you can set tokens on dashboard initialization. Why is this important? Because you can set a token with the string of the token in the search! Is it pretty? Nope. Does it work? Yep!

Add this to the beginning of the dashboard:

<init><set token="map_token"><![CDATA[$field_from_base_search$]]></set></init>

NOTE: You need the CDATA in order to state that this is a "string" as far as dashboard tokens go.

And now your panel becomes:

<panel><table><search base="some_preproccesed_search"><query>map [ search $map_token$]</query></search></table></panel>

In effect, this allows the dashboard to set the token to a string, that then gets replaced when the search is executed!

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Set_tokens_on_page_load

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!