another problem to display $tokens$ with a default...

crazyeva · ‎01-21-2016

Hi, my page string :

<form>
  <panel>
    <search>
      <query>
        index=_internal earliest=-1h
       |stats c
      </query>
      <preview>
        <set token="to_display">$result.c$</set>
      </preview>
    </search>
    <html>
      <h1>total: $to_display$</h1>
    </html>
  </panel>
</form>

when query excuted, on the xml page will correctly display the 'stats count value' as total:200
but before that , when the token is not set yet, it shows total:$to_display$ directly for a while then changes to its value, could i hide the token name or set it with a default value such as "-" ?

chimell · ‎01-22-2016

Hi crazyeva
use exactly this xml code i tested it , it works well

<dashboard>
  <label>tok-essai</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats c</query>
          <earliest></earliest>
          <latest></latest>
          <preview>
         <set token="to_display">$result.c$</set>
       </preview>
        </search>
      </table>
      <html>
       <h1>total: $to_display$</h1>
     </html>
    </panel>
  </row>
</dashboard>

chimell · ‎01-22-2016

i think that if total:$to_display$ appear directly it is because progress bar go slowly

another problem to display $tokens$ with a default value

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases