Dashboards & Visualizations

Why doesn't the eval token for correcting hostname work in the following dashboard?

djcmay
Explorer

Hi everybody,

I have the following problem:

On the first dashboard, there are a lot of panels, which should link to a more detailed view about a special host. On most of the charts, the link does work. But on one panel, the $click.name2$ Value is not "host" but "send: host" or "received: host". I have found a way to correct it on this panel, so I thought, I could change the host in the detail view:

<init>
     <eval token="form.tok_host"> replace($form.tok_host$, ".*?([^\s]+)$", "\1")</eval>
</init>

I even tried 'form.tok.host' instead of $form.tok_host$.

But seems like, this just sets the token to blank. Does anybody know an answer to this problem?

Greetings
Christoph

Tags (2)
0 Karma

renjith_nair
Legend

@djcmay,

init will set the token on the page load and the panel token might not have set at the time. So you could set the token in the drill down using eval. You may change the eval statements with your working regex.

Please find below a run anywhere example. Try and let's know if it works for you.

<dashboard>
  <label>Drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=2 |eval send:host="localhost"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
        <!--  Change this eval statement according to your requirement-->
          <eval token="tok_host">mvindex(split($click.name2$,":"),1)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tok_host$">
      <table>
        <search>
          <query>index=_* $tok_host$=*|stats count by $tok_host$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

renjith_nair
Legend

@djcmay, did it work for you ?

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...