Splunk IT Service Intelligence

Generate Token without Panel

logankinman99
Path Finder

I'm working on making an interactive dashboard, and I'm not sure how to do something...

My dashboard shows a pie chart of the top servers where errors are occurring. Next to it, a statistics table shows from what file source the top errors are coming from.
What I'm trying to figure out is how I would be able to click on a file source in the statistics table, and then change the pie chart to show only the servers that have errors matching with that clicked source.

Currently, I have it set up as errorSource=* for my pie chart, but that doesn't allow for token change. It would make sense to me to initialize something like $errorSourceToken=*$, but I don't know how I would initialize that without some kind of input like a radio button select or something (which I don't want to appear).

Let me know if you know of any solutions. Thanks so much!
-Logan

0 Karma
1 Solution

logankinman99
Path Finder

Well, I quickly found a solution to my own question. For anyone else who may have this problem...

It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.

< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>

< /form>

After setting that in the XML, I was able to edit the drilldown through the UI

View solution in original post

0 Karma

woodcock
Esteemed Legend

To generate a token without a panel, you can use a base_search and then an eval token in the change section. Also, you can just hard-code non-search-results based tokens at the top of your XML like this:

  <init>
    <!-->For some reason, in drilldown URLs, $APP$, just DOES NOT WORK!<-->
    <!-->It ought to be that setting 'env_app' to a value of '$APP$' works, but it does NOT!<-->
    <set token="env_app">MyHardCodedAppNameHere</set>
  </init>
0 Karma

logankinman99
Path Finder

Well, I quickly found a solution to my own question. For anyone else who may have this problem...

It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.

< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>

< /form>

After setting that in the XML, I was able to edit the drilldown through the UI

0 Karma

vik_splunk
Communicator

@logankinman99 that can certainly be down using the contextual drilldown approach

You will have to set a token based on the clicked value. Examples below

Hope that helps.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/ContextualDrilldown

https://answers.splunk.com/answers/405291/how-to-change-the-search-based-on-a-clicked-table.html

Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...