Dashboards & Visualizations

Token referencing another token


Morning, Splunkers.

I've got a dashboard that gets some of it's input from an external link. The input that comes in determines which system is being displayed by the dashboard with different settings through a <change> line in each, then shows the necessary information in a line graph.

That part is working perfectly, but what I'm trying to do is set the color of the line graph based on the system chosen, and I'm trying to keep is simple for future edits.

I've set the colors I'm currently using in the <init> section as follows:


  <set token="red">0xFF3333</set>
  <set token="purple">0x8833FF</set>
  <set token="green">0x00FF00</set>


The system selection looks like this:


<input token="system" depends="$NotDisplayed$">
    <condition value="System-A">
      <set token="index_filter">index_A</set>
      <set token="display_name">System-A</set>
      <set token="color">$purple$</set>
    <condition value="System-B">
      <set token="index_filter">index_B</set>
      <set token="display_name">System-B</set>
      <set token="color">$green$</set>
      <condition value="System-C">
      <set token="index_filter">index_C</set>
      <set token="display_name">System-C</set>
      <set token="color">$red$</set>



I now have a single query window putting up a line graph with the necessary information brought in from the eternal link. Like I said above, that part works perfectly, but what DOESN'T work is the color. Here's what my option field currently looks like:


<option name="charting.fieldColors">{"MyField":$color$}</option>



The idea here is if I add future systems, I don't have to keep punching in hex codes for colors, I just enter a color name token. Unfortunately, what ends up happening is the line graph color is black, no matter what color I use. If I take the $color$ token out of the code and put in the hex code directly it works fine. It also works if I put the hex code directly in the system selection instead of the color name token.

Is there a trick to having a token reference another token in a dashboard? Or is this one of those "quit being fancy and do it the hard way" type of things?

Any help will be appreciated. Running Splunk 8.2.4, in case it matters.

Labels (2)
0 Karma


iirc this part of the SimpleXML is not re-evaluated after the dashboard is loaded, therefore the tokens can't be used here. iirc, the way approached this is to use CSS where tokens are evaluated. The trick with using CSS is identifying the element you want to change the style of so depending on how dynamic your charts are or how different they are for each system, this may prove to be quite tricky!


I was afraid of that. It's no big deal, I can hand-jam in the hex code for each system.

Thanks for the response!

0 Karma


Hey @A_VA,

Can you try wrapping the color token in quotes as "$red|s$". I believe this should work. 

Relevant document: https://docs.splunk.com/Documentation/Splunk/9.2.1/Viz/tokens#Syntax_to_consume_tokens





If the above solution helps, an upvote is appreciated.


Sadly, no, that didn't work. No biggie, I can hand-jam in the hex code for each system, I was just hoping to get a little too fancy.

Thanks, though!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...