Dashboards & Visualizations

Can I pass macros dynamically in the panels?

smruti13
Observer

I have created a drop down called Tower which is taking values from a lookup table and displaying the project names. Whenever I click on a particular project I want the macros used in that particular project to be passed to the panels . Is it possible?

Tags (2)
0 Karma
1 Solution

vasanthmss
Motivator

yes, you can pass the macro's based on the token selection.

basic sample code:

<form>
  <label>Form example: source type time chart</label>

  <!--autoRun means the search runs as soon as it is loaded. -->
  <!-- Do not need a submit button                           -->
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="sourcetype_tok">
      <label>Select a source type</label>
      <default>splunkd</default>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunk_web_access">splunk_web_access</choice>
      <choice value="splunkd_ui_access">splunkd_ui_access</choice>
    </input>
  </fieldset>

  <row>
    <panel>
      <chart>
        <search>
          <query>
            index = _internal sourcetype=$sourcetype_tok$ 
            | timechart count by sourcetype
          </query>
            <earliest>-7d</earliest>
            <latest>-0d</latest>
        </search>
      </chart>
    </panel>
  </row>
</form>

Insead of query use the following,

         <query>
           `your_macro($<your token>$)`
          </query>

In-case if you want to create / populate the macro you have to use sub search .

samples: https://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms

V

View solution in original post

vasanthmss
Motivator

yes, you can pass the macro's based on the token selection.

basic sample code:

<form>
  <label>Form example: source type time chart</label>

  <!--autoRun means the search runs as soon as it is loaded. -->
  <!-- Do not need a submit button                           -->
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="sourcetype_tok">
      <label>Select a source type</label>
      <default>splunkd</default>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunk_web_access">splunk_web_access</choice>
      <choice value="splunkd_ui_access">splunkd_ui_access</choice>
    </input>
  </fieldset>

  <row>
    <panel>
      <chart>
        <search>
          <query>
            index = _internal sourcetype=$sourcetype_tok$ 
            | timechart count by sourcetype
          </query>
            <earliest>-7d</earliest>
            <latest>-0d</latest>
        </search>
      </chart>
    </panel>
  </row>
</form>

Insead of query use the following,

         <query>
           `your_macro($<your token>$)`
          </query>

In-case if you want to create / populate the macro you have to use sub search .

samples: https://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms

V
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...