Dashboards & Visualizations

Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments

kulick
Path Finder

I am having trouble supporting both URL link parameters for a form input/token and "derived" value tokens which are computed from the value of a form token. As an example, imagine that I have two tokens, tok and derived. The token derived is set when token tok is changed, as follows...

      <input token=“tok”>
        <label>Summary Interval</label>
        <choice value="10minute">10 minutes</choice>
        <choice value="1hour">1 hour</choice>
        <choice value="1day">1 day</choice>
        <default>1hour</default>
        <change>
          <condition value="10minute">
            <eval token="derived">minspan=10m</eval>
          </condition>
          <condition>
            <set token="derived"></set>
          </condition>
        </change>
      </input>

The problem comes when a user links to this dashboard setting tok to "10minute" in the URL (with something like "tok=10minute" in the args). In this case, it seems that the token derived will not be set at all, causing any dependent dashboard panels to wait on token input.

I can work around by computing derived in a search instead, but it sure is convenient to simply set such a related (derived) token right here in the token it depends on. Does this usage of a change clause in the input pretty much ensure that bookmarks and other URL links containing token tok will be a problem?

0 Karma
1 Solution

@kulick do you have searchWhenChanged for input set to true and submitButton turned false?

Also instead of <eval> use <set> to set the derived token in your dashboard

<set token="derived">minspan=10m</set>

PS: I tried the following code and it worked fine.

Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set

<dashboard>
  <label>Source dashboard with time span</label>
  <row>
    <panel>
      <html>
        <a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
      </html>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard with span input</label>
  <fieldset submitButton="false">
    <input type="dropdown" searchWhenChanged="true" token="tokSummary">
      <label>Summary Interval</label>
      <choice value="10minute">10 minutes</choice>
      <choice value="1hour">1 hour</choice>
      <choice value="1day">1 day</choice>
      <default>1hour</default>
      <change>
        <condition value="10minute">
          <set token="derived">minspan=10m</set>
        </condition>
        <condition>
          <set token="derived"> </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval inputToken="$tokSummary$",derived="$derived$"</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

@kulick do you have searchWhenChanged for input set to true and submitButton turned false?

Also instead of <eval> use <set> to set the derived token in your dashboard

<set token="derived">minspan=10m</set>

PS: I tried the following code and it worked fine.

Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set

<dashboard>
  <label>Source dashboard with time span</label>
  <row>
    <panel>
      <html>
        <a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
      </html>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard with span input</label>
  <fieldset submitButton="false">
    <input type="dropdown" searchWhenChanged="true" token="tokSummary">
      <label>Summary Interval</label>
      <choice value="10minute">10 minutes</choice>
      <choice value="1hour">1 hour</choice>
      <choice value="1day">1 day</choice>
      <default>1hour</default>
      <change>
        <condition value="10minute">
          <set token="derived">minspan=10m</set>
        </condition>
        <condition>
          <set token="derived"> </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval inputToken="$tokSummary$",derived="$derived$"</query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

kulick
Path Finder

Sorry for the slow reply and thanks for the code review.  Definitely misused eval there in my example.  I will use searchWhenChanged="true" in the future.  Thanks!

 

0 Karma

to4kawa
Ultra Champion

Set_tokens_on_page_load

set <init>, how about this?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...