So I'm trying to have a map command within a Simple XML dashboard. However, tokens work differently, causing my panel that has the map command to not display any information, and fails with "Waiting for Input".
Example:
<panel><table><search base="some_preproccesed_search"><query>map [ search $field_from_base_search$]</query></search></table></panel>
But since $field_from_base_search$
doesn't exist as a token in the dashboard, it sits and waits for input! Oh My! Whatever shall I do!?
(original question here: https://answers.splunk.com/answers/119666/splunkjs-html-dashboards-map-command-foo-substitution.html)
Well, Me, I'll tell you! New in Splunk 6.5, you can set tokens on dashboard initialization. Why is this important? Because you can set a token with the string of the token in the search! Is it pretty? Nope. Does it work? Yep!
Add this to the beginning of the dashboard:
<init><set token="map_token"><![CDATA[$field_from_base_search$]]></set></init>
NOTE
: You need the CDATA in order to state that this is a "string" as far as dashboard tokens go.
And now your panel becomes:
<panel><table><search base="some_preproccesed_search"><query>map [ search $map_token$]</query></search></table></panel>
In effect, this allows the dashboard to set the token to a string, that then gets replaced when the search is executed!
http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Set_tokens_on_page_load
Well, Me, I'll tell you! New in Splunk 6.5, you can set tokens on dashboard initialization. Why is this important? Because you can set a token with the string of the token in the search! Is it pretty? Nope. Does it work? Yep!
Add this to the beginning of the dashboard:
<init><set token="map_token"><![CDATA[$field_from_base_search$]]></set></init>
NOTE
: You need the CDATA in order to state that this is a "string" as far as dashboard tokens go.
And now your panel becomes:
<panel><table><search base="some_preproccesed_search"><query>map [ search $map_token$]</query></search></table></panel>
In effect, this allows the dashboard to set the token to a string, that then gets replaced when the search is executed!
http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Set_tokens_on_page_load