Splunk IT Service Intelligence

Generate Token without Panel

logankinman99
Path Finder

I'm working on making an interactive dashboard, and I'm not sure how to do something...

My dashboard shows a pie chart of the top servers where errors are occurring. Next to it, a statistics table shows from what file source the top errors are coming from.
What I'm trying to figure out is how I would be able to click on a file source in the statistics table, and then change the pie chart to show only the servers that have errors matching with that clicked source.

Currently, I have it set up as errorSource=* for my pie chart, but that doesn't allow for token change. It would make sense to me to initialize something like $errorSourceToken=*$, but I don't know how I would initialize that without some kind of input like a radio button select or something (which I don't want to appear).

Let me know if you know of any solutions. Thanks so much!
-Logan

0 Karma
1 Solution

logankinman99
Path Finder

Well, I quickly found a solution to my own question. For anyone else who may have this problem...

It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.

< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>

< /form>

After setting that in the XML, I was able to edit the drilldown through the UI

View solution in original post

0 Karma

woodcock
Esteemed Legend

To generate a token without a panel, you can use a base_search and then an eval token in the change section. Also, you can just hard-code non-search-results based tokens at the top of your XML like this:

  <init>
    <!-->For some reason, in drilldown URLs, $APP$, just DOES NOT WORK!<-->
    <!-->It ought to be that setting 'env_app' to a value of '$APP$' works, but it does NOT!<-->
    <set token="env_app">MyHardCodedAppNameHere</set>
  </init>
0 Karma

logankinman99
Path Finder

Well, I quickly found a solution to my own question. For anyone else who may have this problem...

It turns out there is an < init> element you can set in the XML, so I ended up setting the field as * as soon as the dashboard loads up.

< form>
-----< label>My dashboard name< /label>
-----< init>
----------< set token="errorSourceToken">*< /set>
-----< /init>

< /form>

After setting that in the XML, I was able to edit the drilldown through the UI

0 Karma

vik_splunk
Communicator

@logankinman99 that can certainly be down using the contextual drilldown approach

You will have to set a token based on the clicked value. Examples below

Hope that helps.

https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/ContextualDrilldown

https://answers.splunk.com/answers/405291/how-to-change-the-search-based-on-a-clicked-table.html

Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...