Dashboards & Visualizations

Am I able to use tokens for a report selection drop-down on a Simple XML dashboard?

bandit
Motivator

I wanted to use tokens to allow the dropdown selection of scheduled reports within a dashboard. Is this possible?

Example simple xml:

<form>
  <label>Dashboard Test</label>
  <description></description>
  <fieldset submitButton="false">
    <input type="dropdown" token="report" searchWhenChanged="true">
      <label>Report Selector</label>
      <choice value="timechart_hosta">Timechart Host A</choice>
      <choice value="timechart_hostb">Timechart Host B</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>$report$</title>
        <search ref="$report$"></search>
        <option name="charting.axisY2.enabled">undefined</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma
1 Solution

bmacias84
Champion

Yes, I would consider using the savedsearch command. It would like something like whats below.

<form>
   <label>Dashboard Test</label>
   <description></description>
   <fieldset submitButton="false">
     <input type="dropdown" token="report" searchWhenChanged="true">
       <label>Report Selector</label>
       <choice value="timechart_hosta">Timechart Host A</choice>
       <choice value="timechart_hostb">Timechart Host B</choice>
     </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>$report$</title>
         <searchString>savedsearch $report$</searchStrin
         <option name="charting.axisY2.enabled">undefined</option>
       </chart>
     </panel>
   </row>
 </form>

View solution in original post

bmacias84
Champion

Yes, I would consider using the savedsearch command. It would like something like whats below.

<form>
   <label>Dashboard Test</label>
   <description></description>
   <fieldset submitButton="false">
     <input type="dropdown" token="report" searchWhenChanged="true">
       <label>Report Selector</label>
       <choice value="timechart_hosta">Timechart Host A</choice>
       <choice value="timechart_hostb">Timechart Host B</choice>
     </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>$report$</title>
         <searchString>savedsearch $report$</searchStrin
         <option name="charting.axisY2.enabled">undefined</option>
       </chart>
     </panel>
   </row>
 </form>

alvaro_garcia
Explorer

Hello Splunkers,
I have a similar problem, in my case I need to use a report, becouse my users dont have acces to the index, is there any way to use tokens or reports with tokens o dropdown menus?

Is there any way to replace the

thanks in advance

0 Karma

bandit
Motivator

Thanks. This is what I got working where it prepends the appropriate host name to call the reports for that host.

<form refresh="600">
  <label>DC Details Clone</label>
  <description></description>
  <fieldset submitButton="false">
    <input type="dropdown" token="report" searchWhenChanged="true">
      <label>Report Selector</label>
      <choice value="hosta">Host A</choice>
      <choice value="hostb">Host B</choice>
      <choice value="hostc">Host C</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>CPU vs. 4 Week Average</title>
        <searchString>savedsearch "$report$ CPU vs. 4 Week Average"</searchString>
        <option name="charting.axisY2.enabled">undefined</option>
      </chart>
    </panel>
  </row>
    <row>

    <panel>

      <chart>

        <title>CPU Today vs. Yesterday</title>

        <searchString>savedsearch "$report$ CPU Today vs. Yesterday"</searchString>

        <option name="charting.axisY2.enabled">undefined</option>

      </chart>

    </panel>

  </row>
</form>
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...