Dashboards & Visualizations

initialisation of tokens on dashboard load not working

jrfrost
Explorer

I am trying set the initial values of a time picker to the values used on a previous dashboard via drilldown tokens.

The tokens are passed OK but the field2.earliest and field2.latest tokens in the are not set so I get an error in the chart 'invalid earliest_time'.

If I edit the dashboard and go to the source view and then back to the UI view the values are set correctly and the chart displays correctly.

It's like the tokens passed in the URL are not evaluated correctly in the section of the xml, they are passed correctly as if I set the default value of a text box to $earliest$ and $latest$ they are shown correctly

<dashboard>
  <label>tr</label>
    <init>
      <set token="field2.earliest">$earliest$</set>
      <set token="field2.latest">$latest$</set>
      <set token="goo">123</set>
    </init>

  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="time">
      <label></label>
      <default>$plcarea$ - $errorname$</default>
    </input>
    <input type="time" token="field2">
      <label></label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
<input type="text" token="field3">
  <label>earliest</label>
  <default>$earliest$</default>
</input>
<input type="text" token="field4">
  <label>latest</label>
  <default>$latest$</default>
</input>
   </fieldset>
  <row>
    <panel>
      <chart depends="$plcchart$">
        <title></title>
        <search>
          <query>index=main  plcarea=$plcarea$ errordescription=$errorname$ | timechart count</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$durationchart$">
        <title>The chart tile is- $plcarea - $errordescription$</title>
        <search>
          <query>index=main plcarea=$plcarea$ errordescription=$errorname$ 
| eval foo=strptime(endts,"%d/%m/%Y %H:%M:%S") 
| eval duration= foo-_time 
| timechart sum(duration)</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma

dtk
Engager

Can you try this:

Go to the js file which is responsible for your dashboard from: APP_directory/appserver/static/javascript/

Add the following lines into your code
 
 var sub_tok = mvc.Components.get("submitted");
 sub_tok.set("earliest", {value for that token});
 sub_tok.set("latest", {value for that token});
 
Dump the splunk and restart your splunk and try again.
0 Karma

mayurr98
Super Champion

can you try this

<form>
  <label>tr</label>
  <init>
    <set token="field2.earliest">$earliest$</set>
    <set token="field2.latest">$latest$</set>
    <set token="goo">123</set>
  </init>
  <fieldset submitButton="false" autoRun="true">
    <input type="text" token="time">
      <label></label>
      <default>$plcarea$ - $errorname$</default>
    </input>
    <input type="time" token="field2">
      <label></label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>
    <input type="text" token="field3">
      <label>earliest</label>
      <default>$field2.earliest$</default>
    </input>
    <input type="text" token="field4">
      <label>latest</label>
      <default>$field2.latest$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart depends="$plcchart$">
        <title></title>
        <search>
          <query>index=main  plcarea=$plcarea$ errordescription=$errorname$ | timechart count</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$durationchart$">
        <title>The chart tile is- $plcarea - $errordescription$</title>
        <search>
          <query>index=main plcarea=$plcarea$ errordescription=$errorname$ 
 | eval foo=strptime(endts,"%d/%m/%Y %H:%M:%S") 
 | eval duration= foo-_time 
 | timechart sum(duration)</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @jrfrost,
Can you please try this?

 <init>
       <set token="field2.earliest">$form.field1.earliest$</set>
       <set token="field2.latest">$form.field1.latest$</set>
       <set token="goo">123</set>
     </init>

Thanks

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...