Dashboards & Visualizations

initialisation of tokens on dashboard load not working

jrfrost
Explorer

I am trying set the initial values of a time picker to the values used on a previous dashboard via drilldown tokens.

The tokens are passed OK but the field2.earliest and field2.latest tokens in the are not set so I get an error in the chart 'invalid earliest_time'.

If I edit the dashboard and go to the source view and then back to the UI view the values are set correctly and the chart displays correctly.

It's like the tokens passed in the URL are not evaluated correctly in the section of the xml, they are passed correctly as if I set the default value of a text box to $earliest$ and $latest$ they are shown correctly

<dashboard>
  <label>tr</label>
    <init>
      <set token="field2.earliest">$earliest$</set>
      <set token="field2.latest">$latest$</set>
      <set token="goo">123</set>
    </init>

  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="time">
      <label></label>
      <default>$plcarea$ - $errorname$</default>
    </input>
    <input type="time" token="field2">
      <label></label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
<input type="text" token="field3">
  <label>earliest</label>
  <default>$earliest$</default>
</input>
<input type="text" token="field4">
  <label>latest</label>
  <default>$latest$</default>
</input>
   </fieldset>
  <row>
    <panel>
      <chart depends="$plcchart$">
        <title></title>
        <search>
          <query>index=main  plcarea=$plcarea$ errordescription=$errorname$ | timechart count</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$durationchart$">
        <title>The chart tile is- $plcarea - $errordescription$</title>
        <search>
          <query>index=main plcarea=$plcarea$ errordescription=$errorname$ 
| eval foo=strptime(endts,"%d/%m/%Y %H:%M:%S") 
| eval duration= foo-_time 
| timechart sum(duration)</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma

dtk
Engager

Can you try this:

Go to the js file which is responsible for your dashboard from: APP_directory/appserver/static/javascript/

Add the following lines into your code
 
 var sub_tok = mvc.Components.get("submitted");
 sub_tok.set("earliest", {value for that token});
 sub_tok.set("latest", {value for that token});
 
Dump the splunk and restart your splunk and try again.
0 Karma

mayurr98
Super Champion

can you try this

<form>
  <label>tr</label>
  <init>
    <set token="field2.earliest">$earliest$</set>
    <set token="field2.latest">$latest$</set>
    <set token="goo">123</set>
  </init>
  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="time">
      <label></label>
      <default>$plcarea$ - $errorname$</default>
    </input>
    <input type="time" token="field2">
      <label></label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="text" token="field3">
      <label>earliest</label>
      <default>$field2.earliest$</default>
    </input>
    <input type="text" token="field4">
      <label>latest</label>
      <default>$field2.latest$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart depends="$plcchart$">
        <title></title>
        <search>
          <query>index=main  plcarea=$plcarea$ errordescription=$errorname$ | timechart count</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$durationchart$">
        <title>The chart tile is- $plcarea - $errordescription$</title>
        <search>
          <query>index=main plcarea=$plcarea$ errordescription=$errorname$ 
 | eval foo=strptime(endts,"%d/%m/%Y %H:%M:%S") 
 | eval duration= foo-_time 
 | timechart sum(duration)</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @jrfrost,
Can you please try this?

 <init>
       <set token="field2.earliest">$form.field1.earliest$</set>
       <set token="field2.latest">$form.field1.latest$</set>
       <set token="goo">123</set>
     </init>

Thanks

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...