token

[lorscardala985]

"I need help with this XML for a dashboard; essentially, I need to call a token that modifies data within a report, having already created the token with the name 'data.' How can I do this?"

<form version="1.1">
  <label>Lista IP da bloccare</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="data">
      <label></label>
      <default>
        <earliest>rt-24h</earliest>
        <latest>rt</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search ref="checkpoint1"></search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

[isoutamo]

Hi

you don't say how you want to use that token. Without that information we cannot directly tell it to you!

You could found from https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens how to use tokens in dashboards.

I'm not sure if you try to use token on that report (checkpoint1) or not? Unfortunately you cannot use tokens in other places than this dashboards or other output links/dashboards.

One app which you should install and use when you are developing dashboards with tokens is https://splunkbase.splunk.com/app/1603. With it you can automatically see what tokens you have defined and what values those have.

r. Ismo 

[lorscardala985]

I'm not sure if I was unclear, but anyway, I wanted to use the token to change, if possible, the data reported by a search that is saved as a report.

[isoutamo]

Yes you said that you want to use it to modify a report, but you didn't define how it should modify.
Basically add normal SPL after your report and use token with $data$ how ever you want to use it.