Dashboards & Visualizations

Is there a way to specify a default value for a token in a saved search?

fduchatelet
Engager

Hi,

I have a report with a parameter ($myspan$) used in a dashboard.

From the dashboard, it works perfectly when the panel is invoked by:
|savedsearch toto myspan="span=2m"

The problem is the the report itself cannot be used as it triggers an error:
Error in 'timechart' command: the specifier '$myspan$' is invalid ...

Which is perfectly correct in this context as the report is specified as:
.... timechart $myspan$ count by country

So, is there a way to specify a default value for this $myspan$ token so that the report is also usable independently of a dashboard ?

I already tried:

  • an eval macro:
    empty(1)
    if(""!="$param","$param","")

  • different forms of eval and/or subsearches

François

0 Karma
1 Solution

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

View solution in original post

0 Karma

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

0 Karma

fduchatelet
Engager

Hi DalJeanis,

It indeed worked :-), but as you said, it is really tied to the specific token and I never managed to implement a macro where the default value can be specified in a macro parameter.

But I solved the problem indirectly, by not using the parametrized report directly, but by building another one using also savedsearch and passing whatever I wanted as parameter value in that case.

Cheers,
François

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...