Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Eval token to be used inside panel
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi everyone.
I have a panel that contains a list of links to other dashboards. I need to create a new list item with a link that changes dinamically according to the values of three tokens evaluated inside "eval" blocks. But, as splunk makes it clear, I can't create "eval" blocks inside of a panel. So I wanted to know if there's a way to evaluate these tokens such that they can be used within the scope of the "panel" block.
Thanks in advance,
Pedro
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use a hidden table like @bowesmana suggests. Or you can use a bare <search/> element without panel, like this:
<form version="1.1">
<label>https://community.splunk.com/t5/forums/replypage/board-id/splunk-search/message-id/242210</label>
<search>
<query>
| makeresults
| eval Link4=https://$token_1$/".$token_2$."/".$token_3"
</query>
<done>
<set token="Link4">$result.Link4$</set>
</done>
</search>
...
<row>
<panel id="panel1">
<title>My Panel</title>
<html>
<style>
...
</style>
</html>
<html>
<li><a href="..." target="..."><b>Link1</b></a></li>
<li><a href="..." target="..."><b>Link2</b></a></li>
<li><a href="..." target="..."><b>Link3</b></a></li>
<li><a href="$Link4$" target="..."><b>$Link4</b></a></li>
</html>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pedropiin
You could create a field returned by the SPL of your search which has an _ (underscore) prefix, this wont be rendered in the visualisation but can be used in the drilldown.
e.g.
| eval _link="https://".$domain$."/".$path$🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @livehybrid
I dont have a drilldown. Its simply a panel of the format:
<panel id="panel1">
<title>My Panel</title>
<html>
<style>
...
</style>
</html>
<html>
<li><a href="..." target="..."><b>Link1</b></a></li>
<li><a href="..." target="..."><b>Link2</b></a></li>
<li><a href="..." target="..."><b>Link3</b></a></li>
</html>
</panel>- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pedropiin
Where do the values currently come from that you want to use within your eval?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know what you mean when you say you can't create eval blocks inside a panel, you can do pretty much whatever you like inside a panel, e.g. you can do this
<panel id="panel1">
<title>My Panel</title>
<html>
<style>
...
</style>
</html>
<html>
<li><a href="..." target="..."><b>Link1</b></a></li>
<li><a href="..." target="..."><b>Link2</b></a></li>
<li><a href="..." target="..."><b>Link3</b></a></li>
<li><a href="..." target="..."><b>$Link4$</b></a></li>
</html>
<table depends="$hidden_table$">
<search>
<query>
| makeresults
| eval Link4=https://$token_1$/".$token_2$."/".$token_3"
</query>
<done>
<set token="Link4">$result.Link4$</set>
</done>
</search>
</table>
</panel>so you have a hidden table inside the panel that performs any search you want and creates any kind of value you need, then the done clause creates the new Link4 token from your result and that $Link4$ token is then used in the <html> section of the panel.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use a hidden table like @bowesmana suggests. Or you can use a bare <search/> element without panel, like this:
<form version="1.1">
<label>https://community.splunk.com/t5/forums/replypage/board-id/splunk-search/message-id/242210</label>
<search>
<query>
| makeresults
| eval Link4=https://$token_1$/".$token_2$."/".$token_3"
</query>
<done>
<set token="Link4">$result.Link4$</set>
</done>
</search>
...
<row>
<panel id="panel1">
<title>My Panel</title>
<html>
<style>
...
</style>
</html>
<html>
<li><a href="..." target="..."><b>Link1</b></a></li>
<li><a href="..." target="..."><b>Link2</b></a></li>
<li><a href="..." target="..."><b>Link3</b></a></li>
<li><a href="$Link4$" target="..."><b>$Link4</b></a></li>
</html>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pedropiin
Is this as a classic XML dashboard or in Dashboard Studio?
Are you able to share what you currently have?
🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @livehybrid. Its a classic XML dashboard. I'm "coding" it without using Dashboard Studio.
My dashboard is pretty big, so I'm afraid I can't share my code. But this panel with the list is one of the first elements of the dashboard.
Thanks,
Pedro
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@pedropiin
Make a hidden search and set your tokens.
And use the token inside your panel.
<row depends="$alwaysHide$">
<panel>
<search id="token_generator">
<query>
| makeresults
| eval tokenA="value1", tokenB="value2", tokenC="value3"
| eval dynamic_link="/app/search/dashboard_name?fieldA=".tokenA."&fieldB=".tokenB."&fieldC=".tokenC
</query>
<done>
<set token="myDynamicLink">$result.dynamic_link$</set>
</done>
</search>
</panel>
</row>
<panel>
<html>
<ul>
<li><a href="$myDynamicLink$">Dynamic Dashboard</a></li>
</ul>
</html>
</panel>Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
