Dashboards & Visualizations

Why doesn't the eval token for correcting hostname work in the following dashboard?

djcmay
Explorer

Hi everybody,

I have the following problem:

On the first dashboard, there are a lot of panels, which should link to a more detailed view about a special host. On most of the charts, the link does work. But on one panel, the $click.name2$ Value is not "host" but "send: host" or "received: host". I have found a way to correct it on this panel, so I thought, I could change the host in the detail view:

<init>
     <eval token="form.tok_host"> replace($form.tok_host$, ".*?([^\s]+)$", "\1")</eval>
</init>

I even tried 'form.tok.host' instead of $form.tok_host$.

But seems like, this just sets the token to blank. Does anybody know an answer to this problem?

Greetings
Christoph

Tags (2)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@djcmay,

init will set the token on the page load and the panel token might not have set at the time. So you could set the token in the drill down using eval. You may change the eval statements with your working regex.

Please find below a run anywhere example. Try and let's know if it works for you.

<dashboard>
  <label>Drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=2 |eval send:host="localhost"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
        <!--  Change this eval statement according to your requirement-->
          <eval token="tok_host">mvindex(split($click.name2$,":"),1)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$tok_host$">
      <table>
        <search>
          <query>index=_* $tok_host$=*|stats count by $tok_host$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>
Happy Splunking!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@djcmay, did it work for you ?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...