Dashboards & Visualizations

Why doesn't the eval token for correcting hostname work in the following dashboard?

djcmay
Explorer

Hi everybody,

I have the following problem:

On the first dashboard, there are a lot of panels, which should link to a more detailed view about a special host. On most of the charts, the link does work. But on one panel, the $click.name2$ Value is not "host" but "send: host" or "received: host". I have found a way to correct it on this panel, so I thought, I could change the host in the detail view:

<init>
     <eval token="form.tok_host"> replace($form.tok_host$, ".*?([^\s]+)$", "\1")</eval>
</init>

I even tried 'form.tok.host' instead of $form.tok_host$.

But seems like, this just sets the token to blank. Does anybody know an answer to this problem?

Greetings
Christoph

Tags (2)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@djcmay,

init will set the token on the page load and the panel token might not have set at the time. So you could set the token in the drill down using eval. You may change the eval statements with your working regex.

Please find below a run anywhere example. Try and let's know if it works for you.

<dashboard>
  <label>Drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=2 |eval send:host="localhost"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
        <!--  Change this eval statement according to your requirement-->
          <eval token="tok_host">mvindex(split($click.name2$,":"),1)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tok_host$">
      <table>
        <search>
          <query>index=_* $tok_host$=*|stats count by $tok_host$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>
Happy Splunking!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@djcmay, did it work for you ?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...