Use .conf/lookup/script to store tokens outside of dashboard xml

[ramgnisiv]

Dear Splunkers,

I have an overview dashboard that dynamically drills down into several hundred dashboards.
This is done by passing tokens. This works great.

I also have certain settings that apply across all dashboards (overview dashboard + all drilldown dashboards).
These settings are for example the earliest=-90d@d or the trendInterval >-30d

Currently, i set these settings as a token on the overview dashboard and i pass these settings as tokens to the downdrill dashboards.

The downsides are that the tokens become part of the url and that i cannot use these tokens in dashboards in my app that are not accessible via a downdrill. I would have to set these tokens on those non-downdrillable dashboards separately.

Question:

Which ways are there to store these tokens outside of my overview dashboard? For example in a lookup, or in a .conf file? Or a script that i can import?

Does anyone have experience with storing tokens outside of the xml of a dashboard and calling them in your dashboard?

[gaurav_maniar · Accepted solution]

Hi,
I guess, I have misunderstood question.
The above text fields you can add in other non-drilldown dashboards. But its a static way.

For dynamics way,
- from overview dashborad once your tokens are set, save them in a csv

<row depends="$hidden$">
    <panel>
      <table>
        <search>
          <query>| makeresults | eval earliest="$earliest$ | eval trendInterval="$trendInterval$" | outputlookup tokens.csv</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>

now other non-drilldown dashboards, load these tokens from lookup

 <row depends="$hidden$">
    <panel>
      <table>
        <search>
          <query>| inputlookup tokens.csv</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <done>
            <set token="earliest">$result.earliest$</set>
            <set token="trendInterval">$result.trendInterval$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>

[ramgnisiv]

Thank you @gaurav_maniar . I will have a go with this one. I've accepted the answer.

[gaurav_maniar]

Hi,

you can add the hidden text fields and use the default text fields values as per the requirement.
Let me know if you have nay queries.

Please Accept & Up-vote the answer if it helps.
happy splunking...!!!

<input type="text" token="earliest" depends="$hidden$">
    <default>-90d@d</default>
</input>
<input type="text" token="trendInterval" depends="$hidden$">
    <default>-30d</default>
</input>

[ramgnisiv]

@gaurav_manier, i assume this hidden text field is still part of the overview dashboard, right?
I don't see how this solution accomplished the requirement to store the tokens outside of my dashboard xml. Can you elaborate?