Hi @LearningGuy It isnt possible to set the token within the dataSources section *however* you can do the following... ...
"viz_gE0iilm3": {
"dataSources": {
"p...
See more...
Hi @LearningGuy It isnt possible to set the token within the dataSources section *however* you can do the following... ...
"viz_gE0iilm3": {
"dataSources": {
"primary": "search1",
"search1": "search1",
"search2": "search2"
},
"options": {
"table": "> $mysearch$"
},
"type": "splunk.table"
}
},
"dataSources": {
"search1": {
"name": "search1",
"options": {
"query": "| makeresults \n| eval msg=\"Search 1\""
},
"type": "ds.search"
},
"search2": {
"name": "search2",
"options": {
"query": "| makeresults \n| eval msg=\"Search2\""
},
"type": "ds.search"
}
},
... What we're doing here is defining the references to the searches under the dataSources section of the viz, so mapping "search1" to the relevant ID of search1 (not the name!), so in your case "ds_index1". Important Note: you *must* have a primary otherwise the viz doesnt seem to load, this could be a basic makeresults empty search, or just search1. Then within the table options we set : "table": "> $mysearch$" This defaults to "> primary" but we are overriding with the dataSource we want it to pull from (as defined in the dataSources section of the Viz) Full example: {
"title": "testing",
"description": "",
"inputs": {
"input_Ldh6KqEz": {
"options": {
"items": [
{
"label": "Data 1",
"value": "search1"
},
{
"label": "Data 2",
"value": "search2"
}
],
"token": "mysearch"
},
"title": "Dropdown Input Title",
"type": "input.dropdown"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
}
}
}
},
"visualizations": {
"viz_gE0iilm3": {
"dataSources": {
"primary": "search1",
"search1": "search1",
"search2": "search2"
},
"options": {
"table": "> $mysearch$"
},
"type": "splunk.table"
}
},
"dataSources": {
"search1": {
"name": "search1",
"options": {
"query": "| makeresults \n| eval msg=\"Search 1\""
},
"type": "ds.search"
},
"search2": {
"name": "search2",
"options": {
"query": "| makeresults \n| eval msg=\"Search2\""
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_Ldh6KqEz"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 960,
"width": 1440
},
"structure": [
{
"item": "viz_gE0iilm3",
"position": {
"h": 300,
"w": 830,
"x": 10,
"y": 30
},
"type": "block"
}
],
"type": "absolute"
}
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
}
} Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing