Splunk Search

declaring a variable in splunk dasboard and make available to all searches

HattrickNZ
Motivator

I have a splunk dashboard with multiple panels/searches. My sample dashboard below.

I want to be able to declare a variable at the top that is available to every search below, on the dashboard.

Can this be done in advanced XML. Appreciate any advise.

My sample dashboard. For example, I am using VaribleX = 500 as the variable to be shared across the dashboard.

<form>
    ...

VaribleX = 500
  <row>
    <panel>
      <title>device=BRT01KPR component="GigabitEthernet1_0_1.200" Mbps</title>
      <table>
        <search>
          <query>
          search 1 ... | timechart span=d sum(VariableX)
          </query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        ...
      </table>
    </panel>
    <panel>
      <title>device=BRT01KPR component="GigabitEthernet1_0_1.200" Mbps</title>
      <table>
        <search>
          <query>
          search 1 ... | timechart span=d sum(VariableX)
          </query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        ...
      </table>
    </panel>
</row>

...

  <row>
    <panel>
      <title>device=BRT01KPR component="GigabitEthernet1_0_1.200" Mbps</title>
      <table>
        <search>
          <query>
          search 1 ... | timechart span=d sum(VariableX)
          </query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        ...
      </table>
    </panel>
    <panel>
      <title>device=BRT01KPR component="GigabitEthernet1_0_1.200" Mbps</title>
      <table>
        <search>
          <query>
          search 1 ... | timechart span=d sum(VariableX)
          </query>
          <earliest>-1d@d</earliest>
          <latest>@d</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        ...
      </table>
    </panel>
</row>

</form>
1 Solution

sgundeti
Path Finder

I believe you want to pass value dynamically..!
You can do this using simple XML and you have started correctly by selecting form. Now you should be able to select input type text from "Add Input" and give label for your variable(My Variable), variable name (VariableX), and default value(500) as optional. Then use your variable in dashboard code as $VariableX$ to replace user input.
your input should look something like shown in screenshot and your search like below.

<query>
           search 1 ... Field=$VariableX$ | .... 
</query>

alt text

View solution in original post

maciep
Champion

If you don't want users selecting that value via an input, you can just use the init tag to set it on dashboard load. Here's a simple example:

<dashboard>
  <label>Init Token</label>
  <init>
    <set token="variableX">splunkd</set>
  </init>
  <row>
    <panel>
      <table>
        <search>
          <query>|  tstats count where index=_internal sourcetype=$variableX$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

HattrickNZ
Motivator

tks both answers are good

0 Karma

sgundeti
Path Finder

I believe you want to pass value dynamically..!
You can do this using simple XML and you have started correctly by selecting form. Now you should be able to select input type text from "Add Input" and give label for your variable(My Variable), variable name (VariableX), and default value(500) as optional. Then use your variable in dashboard code as $VariableX$ to replace user input.
your input should look something like shown in screenshot and your search like below.

<query>
           search 1 ... Field=$VariableX$ | .... 
</query>

alt text

HattrickNZ
Motivator

tks both answers are good

0 Karma

HattrickNZ
Motivator

<form hideFilters="true"> to hide the filters

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...