- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How to clear/reset the value of a token?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello all.
I am making a dashboard in which I was in the need to create a subsearch. This is the piece of code that does it:
<panel>
<title>random panel title</title>
<table depends="$show_debug$">
<search id="Build_list">
<query>index= here it goes my query |fields * |table important_field |format</query>
<finalized>
<condition match=" 'job.resultCount' != 0">
<set token="my_list">$result.search$</set>
</condition>
<condition>
<unset token="my_list"></unset>
</condition>
</finalized>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<title>another panel</title>
<html depends="$show_debug$">
<h3>$my_list$</h3>
</html>
</panel>
and here I am using the $my_list$ token:
<search>
<query>$my_list$ | foreach
something.* [rename "<<FIELD>>" as
"<<MATCHSEG1>>"]
| stats
values(Url),values(UrlDomain)</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
This worked well the first time, but now, for every new query I do, no matter if I close and open a new browser/splunk session, I see still the results of the first query I did. is like $my_list$ has the first ever values hardened and I cannot reset them. I though that <unset token="my_list"></unset> would clear it but not....
Any help please? The goal here is to use this $my_list$ token, which is a splunk query (note the |format at the end of the query) but of course this token needs to be empty every time I run a new query.
Thanks a lot in advance.
Mario
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Mario,
in the input section, you could add a panel like this (obviously to adapt to your tokes:
<input type="radio" token="resetTokens" searchWhenChanged="true">
<label></label>
<choice value="reset">Reset Inputs</choice>
<choice value="retain">Retain</choice>
<default>retain</default>
<change>
<condition value="reset">
<unset token="token1"></unset>
<unset token="token2"></unset>
<unset token="token3"></unset>
<set token="resetTokens">retain</set>
</condition>
</change>
</input>Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how would I do this with a *link* field type? I just want a button that says 'SUBMIT" so the user can reset the tokens.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @makelovenotwar,
you can do this using a JavaScript, but I'm not an expert in JS so I cannot help you more.
But using my solution, you have a reset button in the header bar.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Mario,
in the input section, you could add a panel like this (obviously to adapt to your tokes:
<input type="radio" token="resetTokens" searchWhenChanged="true">
<label></label>
<choice value="reset">Reset Inputs</choice>
<choice value="retain">Retain</choice>
<default>retain</default>
<change>
<condition value="reset">
<unset token="token1"></unset>
<unset token="token2"></unset>
<unset token="token3"></unset>
<set token="resetTokens">retain</set>
</condition>
</change>
</input>Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ciao Beppe!
I am so sorry I thought I marked your reply as solution before. I have just done it now.
Grazie mille!
Introducing the Splunk Community Dashboard Challenge!
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Wondering How to Build Resiliency in the Cloud?
