Dashboards & Visualizations

$env:$ tokens do not resolve within evaluation of a different token?

camillak
Path Finder

I'm posting this question mostly because it's maddening. I want a dashboard that is shared between two apps to behave differently based on the value of $env:app$.

Doesn't work:

    <init>
      <eval token="isMyApp>if($env:app$=="myApp", "true", null())</eval>
    </init>

If I run a search as follows:

        <search>
          <query>| makeresults | eval foo = if($env:app|s$=="myApp", "true", null())</query>
        <done>
          <set token="showMyAppPanels">$result.foo$</set>
          <eval token="iAmBroken">if($env:app|s$=="myApp", "true", null())</eval>
          <eval token="meToo">if($env:app$=="myApp", "true", null())</eval>
        </done>
        </search>

The $result.foo$ evaluates correctly but the other two return null regardless of the value of $env:app$. So with $result.foo$, or some JS I can get where I need to be, but why does it take running an extra search or script to get there?

0 Karma

camillak
Path Finder

furthermore <set token="appContext">$env:app$</set> returns undefined.

0 Karma
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...