- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How to clear/reset the value of a token?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello all.
I am making a dashboard in which I was in the need to create a subsearch. This is the piece of code that does it:
<panel>
<title>random panel title</title>
<table depends="$show_debug$">
<search id="Build_list">
<query>index= here it goes my query |fields * |table important_field |format</query>
<finalized>
<condition match=" 'job.resultCount' != 0">
<set token="my_list">$result.search$</set>
</condition>
<condition>
<unset token="my_list"></unset>
</condition>
</finalized>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<title>another panel</title>
<html depends="$show_debug$">
<h3>$my_list$</h3>
</html>
</panel>
and here I am using the $my_list$ token:
<search>
<query>$my_list$ | foreach
something.* [rename "<<FIELD>>" as
"<<MATCHSEG1>>"]
| stats
values(Url),values(UrlDomain)</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
This worked well the first time, but now, for every new query I do, no matter if I close and open a new browser/splunk session, I see still the results of the first query I did. is like $my_list$ has the first ever values hardened and I cannot reset them. I though that <unset token="my_list"></unset> would clear it but not....
Any help please? The goal here is to use this $my_list$ token, which is a splunk query (note the |format at the end of the query) but of course this token needs to be empty every time I run a new query.
Thanks a lot in advance.
Mario
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Mario,
in the input section, you could add a panel like this (obviously to adapt to your tokes:
<input type="radio" token="resetTokens" searchWhenChanged="true">
<label></label>
<choice value="reset">Reset Inputs</choice>
<choice value="retain">Retain</choice>
<default>retain</default>
<change>
<condition value="reset">
<unset token="token1"></unset>
<unset token="token2"></unset>
<unset token="token3"></unset>
<set token="resetTokens">retain</set>
</condition>
</change>
</input>Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how would I do this with a *link* field type? I just want a button that says 'SUBMIT" so the user can reset the tokens.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @makelovenotwar,
you can do this using a JavaScript, but I'm not an expert in JS so I cannot help you more.
But using my solution, you have a reset button in the header bar.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Mario,
in the input section, you could add a panel like this (obviously to adapt to your tokes:
<input type="radio" token="resetTokens" searchWhenChanged="true">
<label></label>
<choice value="reset">Reset Inputs</choice>
<choice value="retain">Retain</choice>
<default>retain</default>
<change>
<condition value="reset">
<unset token="token1"></unset>
<unset token="token2"></unset>
<unset token="token3"></unset>
<set token="resetTokens">retain</set>
</condition>
</change>
</input>Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ciao Beppe!
I am so sorry I thought I marked your reply as solution before. I have just done it now.
Grazie mille!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This solution is for classic dashboard. How do it in Dashboard studio ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to use another search to (conditionally) set the result field to null and use the results tokens from the search. For example:
{
"visualizations": {
"viz_F0Z9jsFU": {
"type": "splunk.singlevalue",
"title": "Speed in km/h",
"dataSources": {
"primary": "ds_eZ6LtdAT"
},
"options": {
"unit": "km/h"
}
},
"viz_p4tcz9dd": {
"type": "splunk.singlevalue",
"dataSources": {
"primary": "ds_RopRdHUj"
},
"title": "Speed in mph",
"options": {
"unit": "mph"
},
"description": "$km per hour : result.kmh$ * 0.621"
}
},
"dataSources": {
"ds_eZ6LtdAT": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| eval kmh=random()%100",
"enableSmartSources": true
},
"name": "km per hour"
},
"ds_RopRdHUj": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| eval speed_in_mph = if($km per hour:result.kmh$ > 50, $km per hour:result.kmh$ * 0.621, null())\n| table speed_in_mph"
},
"name": "kmh to mph"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-24h@h,now"
},
"title": "Global Time Range"
}
},
"layout": {
"type": "absolute",
"options": {
"width": 1440,
"height": 960,
"display": "auto"
},
"structure": [
{
"item": "viz_F0Z9jsFU",
"type": "block",
"position": {
"x": 10,
"y": 10,
"w": 250,
"h": 250
}
},
{
"item": "viz_p4tcz9dd",
"type": "block",
"position": {
"x": 290,
"y": 10,
"w": 250,
"h": 250
}
}
],
"globalInputs": [
"input_global_trp"
]
},
"description": "",
"title": "Evaluate tokens using search"
}Adapted from documentation example here
Index This | I’m short for "configuration file.” What am I?
New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...
Your Guide to SPL2 at .conf24!
