Dashboards & Visualizations

How to create a Dashboard with Field values wrapped in dollar symbols ($) within dashboards, exclude from tokens?

iomega311
Explorer

I am working with Splunk and Service Now... within Service Now we are able to pass variable field values by using the following notation:
$result.my_cool_field$

So, if an event severity could change based on certain things... I may have SPL logic that creates a field named "event_severity" that can be anywhere between 1-4... 

I then want to generate an alert within Splunk and have that open up an incident within Service Now... which I can have the incident severity change by putting the variable of $result.event_severity$. 
This works great!

Now I am creating some dashboards that will help look through all of our alerts and dump out titles, severity, permissions, etc...
I am using the rest API to bring back the data... which works great, except that some of the alert severity values have been set at specific values (ie: "1", "2", etc)... and then some are variable, so the value is not a number, but instead a variable mentioned above ($result.event_severity$).

The issue that I am running into, is that when I pull in all of the alerts, along with their severities... it is causing issues in the dashboard due to the field name being wrapped in Dollar Symbols ("$").

The dashboard then treats these field names as dashboard tokens... and then the dashboard component won't do anything, because it is waiting for "input"... in other words, it is waiting for some value that will never be set, to replace the field name that it thinks is a variable.

Is there any way to escape the dollar symbols within the SPL when I am querying for field names?

| rest /servicesNS/-/-/saved/searches
| search disabled=0 eai:acl.app=my_cool_app severity IN ("1","$result.event_severity$")

I need it to return alerts where severity=1 OR severity=$result.event_severity$... but the dashboard panel won't do it, because it is treating "$result.event_severity$" as a dashboard token.

Any help is very appreciated!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try doubling up the dollar signs

| search disabled=0 eai:acl.app=my_cool_app severity IN ("1",$$result.event_severity$$)

View solution in original post

iomega311
Explorer

Thank you so much! This did the trick!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try doubling up the dollar signs

| search disabled=0 eai:acl.app=my_cool_app severity IN ("1",$$result.event_severity$$)
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...