Dashboards & Visualizations

How to Pass A Token value through to another selection of token values

flynnrya
New Member

Hi,

So I have a dashboard that returns server metrics that has several parameters that I want to search by,

  1. APPLICATION that the server operates under
  2. ENVIRONMENT that the server operates in (e.g. Production, Dev, Testing)
  3. TIME over which I want to search metrics by

What I am looking to add is another drop-down input that allows me to look up servers according their server TYPE (e.g. App Server, Web Server, Database), after choosing token values for the other previously mentioned drop-down inputs. How do I go about making this happen?

0 Karma

bic
Explorer

We had similar issue in recent past , the issue was resolved by passing $value$.
Ex-

$token1$=$token2$ (this is going to take previous set value of token2 as you faced)

instead use $value$

$value$

Hope this helps

0 Karma

jkat54
SplunkTrust
SplunkTrust

A careful read of this will answer all of your questions:

http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/tokens

But here is a simple example too:

   <input type="dropdown" token="application" searchWhenChanged="true">
     <label>Select an Application</label>
     <choice value="*">All</choice>
     <search>
       <query>index=yourIndex application=*|dedup application | table application</query>
       <earliest>-24h@h</earliest>
       <latest>now</latest>
     </search>
     <fieldForLabel>application</fieldForLabel>
     <fieldForValue>application</fieldForValue>
     <prefix>application="</prefix>
     <suffix>"</suffix>
     <default>*</default>
   </input>
<input type="dropdown" token="environment" searchWhenChanged="true">
     <label>Select an Environment</label>
     <choice value="*">All</choice>
     <search>
       <query>index=yourIndex $application$ environment=* |dedup environment | table environment</query>
       <earliest>-24h@h</earliest>
       <latest>now</latest>
     </search>
     <fieldForLabel>environment</fieldForLabel>
     <fieldForValue>environment</fieldForValue>
     <prefix>environment="</prefix>
     <suffix>"</suffix>
     <default>*</default>
   </input>
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...