Dashboards & Visualizations

Token referencing another token

A_VA
Explorer

Morning, Splunkers.

I've got a dashboard that gets some of it's input from an external link. The input that comes in determines which system is being displayed by the dashboard with different settings through a <change> line in each, then shows the necessary information in a line graph.

That part is working perfectly, but what I'm trying to do is set the color of the line graph based on the system chosen, and I'm trying to keep is simple for future edits.

I've set the colors I'm currently using in the <init> section as follows:

 

<init>
  <set token="red">0xFF3333</set>
  <set token="purple">0x8833FF</set>
  <set token="green">0x00FF00</set>
</init>

 

The system selection looks like this:

 

<input token="system" depends="$NotDisplayed$">
  <change>
    <condition value="System-A">
      <set token="index_filter">index_A</set>
      <set token="display_name">System-A</set>
      <set token="color">$purple$</set>
    </condition>
    <condition value="System-B">
      <set token="index_filter">index_B</set>
      <set token="display_name">System-B</set>
      <set token="color">$green$</set>
    </condition>
      <condition value="System-C">
      <set token="index_filter">index_C</set>
      <set token="display_name">System-C</set>
      <set token="color">$red$</set>
    </condition>
  </change>
</input>

 

 

I now have a single query window putting up a line graph with the necessary information brought in from the eternal link. Like I said above, that part works perfectly, but what DOESN'T work is the color. Here's what my option field currently looks like:

 

<option name="charting.fieldColors">{"MyField":$color$}</option>

 

 

The idea here is if I add future systems, I don't have to keep punching in hex codes for colors, I just enter a color name token. Unfortunately, what ends up happening is the line graph color is black, no matter what color I use. If I take the $color$ token out of the code and put in the hex code directly it works fine. It also works if I put the hex code directly in the system selection instead of the color name token.

Is there a trick to having a token reference another token in a dashboard? Or is this one of those "quit being fancy and do it the hard way" type of things?

Any help will be appreciated. Running Splunk 8.2.4, in case it matters.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

iirc this part of the SimpleXML is not re-evaluated after the dashboard is loaded, therefore the tokens can't be used here. iirc, the way approached this is to use CSS where tokens are evaluated. The trick with using CSS is identifying the element you want to change the style of so depending on how dynamic your charts are or how different they are for each system, this may prove to be quite tricky!

A_VA
Explorer

I was afraid of that. It's no big deal, I can hand-jam in the hex code for each system.

Thanks for the response!

0 Karma

tej57
Communicator

Hey @A_VA,

Can you try wrapping the color token in quotes as "$red|s$". I believe this should work. 

Relevant document: https://docs.splunk.com/Documentation/Splunk/9.2.1/Viz/tokens#Syntax_to_consume_tokens

 

Thanks,
Tejas.

 

---

If the above solution helps, an upvote is appreciated.

A_VA
Explorer

Sadly, no, that didn't work. No biggie, I can hand-jam in the hex code for each system, I was just hoping to get a little too fancy.

Thanks, though!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...