Getting Data In

Using tokens in Base and Chain searches in Dashboard studio


I'm still struggling getting some basic xml tokenization concepts working in Dashboard studio.

I have a simple text box input someone types into.  from there, I want that to set a token that I use in the base search.  Next thing I want to do is take a field value pair in the results and set the value in a token to use in another panel thats going to fill in a URL and grab an image


Base ds_lrth34 datasource:

Textbox -> Chain Search off ds_lrth34 that runs 



.. | fields MyField



I want to do something that I would have otherwise done this way in simple XML:



<set token="myField">$result.MyField$</set>



 but I havent found a structure to make this work at all so that when I create an image viz I could do something like this:


"visualizations": {
		"viz_TRhGkelt": {
			"type": "viz.img",
			"options": {
				"src": "$MyField$&Size=L"


This is heavily utilized methodology in our simple xml dashboards, I would love the right way to tokenize things like this in the new workflow.

Labels (1)
Tags (1)
0 Karma


*really* need this functionality.  Any idea when it will become available?  @elizabethl_splu 

0 Karma

Splunk Employee
Splunk Employee

Hi @wryanthomas - thanks for following up! We're actively developing enhancements for tokens support, and hope to have some updates to share with you soon! 

0 Karma

Splunk Employee
Splunk Employee

Hi @mjones414 - thanks for your question.

What you're looking to do - use a search result as a token value - is not yet supported, but is actively being developed! 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>