Splunk dashboard - token in search query

Question

I'm new to Splunk, and I'm investigating the structure of an XML dashboard. I see the following in the code:

    <input id="input" type="dropdown" token="serve" searchWhenChanged="false">
      <label>Serve</label>
      <fieldForLabel>serve</fieldForLabel>
      <fieldForValue>name</fieldForValue>
      <search id="search_serve">
        <query>$custom_search$</query>
        <earliest></earliest>
        <latest></latest>
      </search>
    </input>

Searching through the complete XML file, I do not see the

$custom_search$

token listed anywhere. Is there another location where this token can be defined?

Honky Donkey Honky Donkey · Accepted Answer · 2020-09-01T21:07:14

Try searching for custom_search instead of $custom_search$ within the XML. When defined, the token won't include the dollar ($) signs. They are only included when the token is used.

What the provided dropdown does, is it dynamically populates dropdown values based on the output of another search passed via custom_search token

Here's an example where the dropdown is populated with the sourcetypes for either _internal or _introspection indexes. Notice how when defined, token is called custom_search

<input type="radio" token="custom_search">

and when used token is used as $custom_search$

<query>$custom_search$</query>

Feel free to slap the example in a dashboard to see it in action

<form>
  <label>Search as token</label>
  <fieldset submitButton="false">
    <input type="radio" token="custom_search">
      <label>Select Index</label>
      <choice value="index=_internal |stats c by sourcetype|table sourcetype">_internal</choice>
      <choice value="index=_introspection |stats c by sourcetype|table sourcetype">_introspection</choice>
      <default>index=_internal |stats c by sourcetype|table sourcetype</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <input id="input" type="dropdown" token="serve" searchWhenChanged="false">
        <label>Sourcetype</label>
        <fieldForLabel>Sourcetype</fieldForLabel>
        <fieldForValue>sourcetype</fieldForValue>
        <search id="search_serve">
          <query>$custom_search$</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </input>
    </panel>
  </row>
</form>

If this fixes your problem, take a moment to accept the answer. This can be done by clicking on the check mark beside the answer to toggle it from greyed out to filled in!

Splunk dashboard - token in search query

1 Answers