Dashboards & Visualizations

How to eval a token in the Init part of dashboard based on another token

santosh_sshanbh
Path Finder

I have 2 custom apps as App_A and App_B. I want to hide a panel based on the current app. For that I have used $env:app$ token. 

Now I want to eval a new token in the Init part of the dashboard which will compare the $env:app$ with App_A or App_B and then generate the value for new token.

I tried various options like case, if but no success. Can any one help me in this scenario?

 

 

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I don't think tokens are available at the init phase, so you can do it using a search and a done clause

  <search>
    <query>
      |makeresults
      | eval app="$env:app$"
    </query>
    <done>
      <eval token="app_a">if($result.app$="app_a","App_A",null())</eval>
      <eval token="app_b">if($result.app$="app_b","App_B",null())</eval>
    </done>
  </search>

with the depends="$app_a/b$" in the appropriate panel definition

Hope this helps

View solution in original post

Tags (1)

bowesmana
SplunkTrust
SplunkTrust

I don't think tokens are available at the init phase, so you can do it using a search and a done clause

  <search>
    <query>
      |makeresults
      | eval app="$env:app$"
    </query>
    <done>
      <eval token="app_a">if($result.app$="app_a","App_A",null())</eval>
      <eval token="app_b">if($result.app$="app_b","App_B",null())</eval>
    </done>
  </search>

with the depends="$app_a/b$" in the appropriate panel definition

Hope this helps

Tags (1)

santosh_sshanbh
Path Finder

Thanks for the help. Your solution worked successfully and I also got to know that tokens are not available in Init part of dashboard.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...