Dashboards & Visualizations

Can I pass a token in Dashboard with 2 values?

kiran331
Builder

Hi,

I have a Dashboard using two different searches. I have a drop down with zone1 and zone2. Is there a way when I select a zone1 to pass two values, each for each panel?

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Assuming your dropdown selection values zone1 and zone2 are static, you set the token value from the dropdown to just the zone names and pass just the zone name to searches as other portion in the eventtype name is constant. So basically, your dropdown xml would be like this

<input type="dropdown" token="zone_tok">
      <label>Select a Zone</label>
      <default>splunkd</default>
      <choice value="zone1">Zone1</choice>
      <choice value="zone2">Zone2</choice>
    </input>

Your panel searches should be like this

Panel1: eventtype= "host_detection_$zone_tok$" |......

Panel2:  eventtype="vm_detection-$zone_tok$" |....
0 Karma

alemarzu
Motivator

Hi there kiran331,

If you create an eventtype for each zone you'll end up with one value as token for each zone, like this.

eventtypes.conf
[zone1]
search = (eventtype="host-detection_zone1" OR eventtype=vm_detection-zone1")
[zone2]
search = (eventtype="host-detection_zone2" OR eventtype=vm_detection-zone2")

Hope it helps.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Could you provide more details? What two values will be passed and from where those two values comes from? How do you want to use those values in your panel searches?

0 Karma

kiran331
Builder

If i select Zone1 its has to pass "host_detection_zone1" & "vm_detection-zone1" and If i select zone2 it has to pass "host_detection_zone2" & "vm_detection-zone2" to the dashboard with is based on the two searches

eventtype= "host_detection_zone1" |......

eventtype="vm_detection-zone1" |....

If i select zone2 it has to show the results of

eventtype= "host_detection_zone2" |......

eventtype="vm_detection-zone2" |....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...