SplunkJS/HTML Dashboards + map command + $foo$ substitution

[alacercogitatus]

So I'm trying to have a map command within a Simple XML dashboard. However, tokens work differently, causing my panel that has the map command to not display any information, and fails with "Waiting for Input".

Example:

<panel><table><search base="some_preproccesed_search"><query>map [ search $field_from_base_search$]</query></search></table></panel>

But since $field_from_base_search$ doesn't exist as a token in the dashboard, it sits and waits for input! Oh My! Whatever shall I do!?

(original question here: https://answers.splunk.com/answers/119666/splunkjs-html-dashboards-map-command-foo-substitution.html)

[alacercogitatus · Accepted solution]

Well, Me, I'll tell you! New in Splunk 6.5, you can set tokens on dashboard initialization. Why is this important? Because you can set a token with the string of the token in the search! Is it pretty? Nope. Does it work? Yep!

Add this to the beginning of the dashboard:

<init><set token="map_token"><![CDATA[$field_from_base_search$]]></set></init>

NOTE: You need the CDATA in order to state that this is a "string" as far as dashboard tokens go.

And now your panel becomes:

<panel><table><search base="some_preproccesed_search"><query>map [ search $map_token$]</query></search></table></panel>

In effect, this allows the dashboard to set the token to a string, that then gets replaced when the search is executed!

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Set_tokens_on_page_load