Dashboards & Visualizations

What is the real difference between a $token$ and $form.token$?

vshakur
Path Finder

When I set up a token named "token" as part of an input component or a condition tag in my dashboard, I can refer to its value or change it either with $token$ or $form.token$.
Sometimes only $token$ works and sometimes $form.token$ so when I want to reset this token I reset both $token$ and $form.token$.
This is really confusing, time wasting and a bad habit. Therefore, I'd like to know when should I use $token$ and when $form.token$?

Thanks,
Sam

1 Solution

pramit46
Contributor

@vshakur

If your token has a physical existence then you should use form.tokenname otherwise you can just use tokenname.

When you use form, that becomes part of the URL in the address bar, hence can be useful for embedding the dashboard with another external application (e.g.: passing token values as preset).

the way I used to understand is: a token without the keyword 'form' is just a volatile variable. On the other hand, when you set the values of any physical input like: textbox or checkbox or dropdown etc. then you use form.token

View solution in original post

pramit46
Contributor

@vshakur

If your token has a physical existence then you should use form.tokenname otherwise you can just use tokenname.

When you use form, that becomes part of the URL in the address bar, hence can be useful for embedding the dashboard with another external application (e.g.: passing token values as preset).

the way I used to understand is: a token without the keyword 'form' is just a volatile variable. On the other hand, when you set the values of any physical input like: textbox or checkbox or dropdown etc. then you use form.token

pramit46
Contributor

@vshakur,

if you think my explanation clarifies your doubt then please accept it as answer, or let me know if you still have any questions.

0 Karma

kmaron
Motivator

You only need $form.token$ when linking outside of your dashboard (like a drilldown link) or between dashboards. Any token that is created and used within the same dashboard should be just $token$

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...