Dashboards & Visualizations

Is there a way to specify a default value for a token in a saved search?

fduchatelet
Engager

Hi,

I have a report with a parameter ($myspan$) used in a dashboard.

From the dashboard, it works perfectly when the panel is invoked by:
|savedsearch toto myspan="span=2m"

The problem is the the report itself cannot be used as it triggers an error:
Error in 'timechart' command: the specifier '$myspan$' is invalid ...

Which is perfectly correct in this context as the report is specified as:
.... timechart $myspan$ count by country

So, is there a way to specify a default value for this $myspan$ token so that the report is also usable independently of a dashboard ?

I already tried:

  • an eval macro:
    empty(1)
    if(""!="$param","$param","")

  • different forms of eval and/or subsearches

François

0 Karma
1 Solution

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

View solution in original post

0 Karma

DalJeanis
Legend

Hmmm. I don't think so, but you could try a different cut at a macro, coded with your specific token.

 if(like(coalesce($myspan$,"$myspan$"),"$myspan$"),"span=2m",$myspan$)

That looks somewhat ridiculous... but it should work whether $myspan$ counts as null, empty or as itself. The only failure is if it generates a higher level error, that would probably give a different error message, before it even got down to the timechart.

0 Karma

fduchatelet
Engager

Hi DalJeanis,

It indeed worked :-), but as you said, it is really tied to the specific token and I never managed to implement a macro where the default value can be specified in a macro parameter.

But I solved the problem indirectly, by not using the parametrized report directly, but by building another one using also savedsearch and passing whatever I wanted as parameter value in that case.

Cheers,
François

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...