Splunk Search

How to set a field as the token to use in a dashboard?

surekhasplunk
Communicator

I have a search which will return me field email id.

index=snow description=*CPU*  |table number sys_created_by

number    sys_created_by
1234      abcd@bcd.com

Now i want to use sys_created_by field as the token to populate my dashboard

How to do this?

index=snow description=*CPU*  |where sys_created_by=$token$
1 Solution

nfilippi_splunk
Splunk Employee
Splunk Employee

You can use the search event handler to dynamically set a token based on the result. Note that the search event handler only tokenizes the first result, which looks like it should work for you.

Here's what it would look like:

<dashboard>
  <label>Test Token</label>

  <search>
    <query>index=snow description=CPU | table number sys_created_by</query>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
    <done>
      <set token="sys_created_by">$result.sys_created_by$</set>
    </done>
  </search>

  <row>
    <panel>
      <table>
        <search>
          <query>index=snow description=CPU sys_created_by=$sys_created_by$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>       
        </search>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

nfilippi_splunk
Splunk Employee
Splunk Employee

You can use the search event handler to dynamically set a token based on the result. Note that the search event handler only tokenizes the first result, which looks like it should work for you.

Here's what it would look like:

<dashboard>
  <label>Test Token</label>

  <search>
    <query>index=snow description=CPU | table number sys_created_by</query>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
    <done>
      <set token="sys_created_by">$result.sys_created_by$</set>
    </done>
  </search>

  <row>
    <panel>
      <table>
        <search>
          <query>index=snow description=CPU sys_created_by=$sys_created_by$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>       
        </search>
      </table>
    </panel>
  </row>
</dashboard>

inventsekar
Super Champion

You can use the token directly inside the query.

  index=snow description=CPU |table number $token$
>>> Happy Splunking !
0 Karma

surekhasplunk
Communicator

Thanks but how do I set the token to sys_created_by field first.
As after setting the token only I can use it like $token$

0 Karma

rodrigorsilva
Communicator

Hi,

Try to check the link below:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens

tks

Rodrigo Ribeiro

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...