Dashboards & Visualizations

Why doesn't the eval token for correcting hostname work in the following dashboard?

djcmay
Explorer

Hi everybody,

I have the following problem:

On the first dashboard, there are a lot of panels, which should link to a more detailed view about a special host. On most of the charts, the link does work. But on one panel, the $click.name2$ Value is not "host" but "send: host" or "received: host". I have found a way to correct it on this panel, so I thought, I could change the host in the detail view:

<init>
     <eval token="form.tok_host"> replace($form.tok_host$, ".*?([^\s]+)$", "\1")</eval>
</init>

I even tried 'form.tok.host' instead of $form.tok_host$.

But seems like, this just sets the token to blank. Does anybody know an answer to this problem?

Greetings
Christoph

Tags (2)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@djcmay,

init will set the token on the page load and the panel token might not have set at the time. So you could set the token in the drill down using eval. You may change the eval statements with your working regex.

Please find below a run anywhere example. Try and let's know if it works for you.

<dashboard>
  <label>Drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=2 |eval send:host="localhost"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
        <!--  Change this eval statement according to your requirement-->
          <eval token="tok_host">mvindex(split($click.name2$,":"),1)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tok_host$">
      <table>
        <search>
          <query>index=_* $tok_host$=*|stats count by $tok_host$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>
Happy Splunking!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@djcmay, did it work for you ?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...