Splunk ITSI

Generate Token without Panel

logankinman99
Path Finder

I'm working on making an interactive dashboard, and I'm not sure how to do something...

My dashboard shows a pie chart of the top servers where errors are occurring. Next to it, a statistics table shows from what file source the top errors are coming from.
What I'm trying to figure out is how I would be able to click on a file source in the statistics table, and then change the pie chart to show only the servers that have errors matching with that clicked source.

Currently, I have it set up as errorSource=* for my pie chart, but that doesn't allow for token change. It would make sense to me to initialize something like $errorSourceToken=*$, but I don't know how I would initialize that without some kind of input like a radio button select or something (which I don't want to appear).

Let me know if you know of any solutions. Thanks so much!
-Logan

0 Karma
1 Solution

logankinman99
Path Finder

Well, I quickly found a solution to my own question. For anyone else who may have this problem...

It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.

< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>

< /form>

After setting that in the XML, I was able to edit the drilldown through the UI

View solution in original post

0 Karma

woodcock
Esteemed Legend

To generate a token without a panel, you can use a base_search and then an eval token in the change section. Also, you can just hard-code non-search-results based tokens at the top of your XML like this:

  <init>
    <!-->For some reason, in drilldown URLs, $APP$, just DOES NOT WORK!<-->
    <!-->It ought to be that setting 'env_app' to a value of '$APP$' works, but it does NOT!<-->
    <set token="env_app">MyHardCodedAppNameHere</set>
  </init>
0 Karma

logankinman99
Path Finder

Well, I quickly found a solution to my own question. For anyone else who may have this problem...

It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.

< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>

< /form>

After setting that in the XML, I was able to edit the drilldown through the UI

0 Karma

vik_splunk
Communicator

@logankinman99 that can certainly be down using the contextual drilldown approach

You will have to set a token based on the clicked value. Examples below

Hope that helps.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/ContextualDrilldown

https://answers.splunk.com/answers/405291/how-to-change-the-search-based-on-a-clicked-table.html

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...