Splunk® Enterprise

Dashboards and Visualizations

Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Token reference

Tokens are a type of variable that can be used to pass values in a simple XML dashboard. This reference lists the types of tokens available for various scenarios.

See Token usage in dashboards for further details on token usage.

Token Type Elements Description
Form input <input> User defined input for referencing the value selected from an input.

See Define tokens for form inputs.

Form input example

Time picker input <input type="time"> Optional user defined input token to associate two or more time pickers with multiple panels in a dashboard.

Contains the earliest and latest modifiers to capture the time range.

See Define tokens for form inputs.

Time input example

Drilldown event <drilldown> Predefined tokens to capture the value from a click in a chart. Dynamic drilldown operations use the captured value from the source chart when accessing the drilldown target.

See Drilldown event tokens for a list of the predefined Drilldown tokens.

Pan and zoom event <selection> Predefined tokens to capture a range of values for a pan and zoom operation. The token values apply to a user selection on the chart. The context of the tokens is only for the chart. Copy the token values into user defined tokens to access the values in the dashboard.

start and end capture the values of the X-axis of a chart for the beginning and end of the selected area. For example, a selection in a time chart captures the starting and ending time of the selection.

start.<field>and end.field capture the values of the Y-axis of a chart at the beginning and end of the selected area. For example, a selection in a time chart captures the number of events for the series specified by <field>.

See Define tokens for pan and zoom chart controls.

Define tokens for pan and zoom chart controls contains an example using a time chart.

Conditional drilldown action <drilldown>
<condition>
<link>
<set>|<unset>
User defined token within a condition element to configure conditional operations. Conditional operations include:
  • Set token values based on the condition.
  • Select a value for a multivalue fields in a visualization.
  • Select a view to open based on a token value.
  • Hide or show panels based on conditions.

See Define tokens for conditional operations with the <drilldown> element.

Conditional form input action <input>
<change>
<condition>
<link>
<set>|<unset>
User defined token within a condition element to modify searches or select which visualization to display based on the conditional value of a token.

See Define tokens for conditional operations with form inputs.

Conditional operations with form inputs example

Set destination action <input>|<drilldown>
<condition>
<link>
<set>|<unset>
Set and unset tokens to specify a target page to open.

Can be used with the <input> element or <drilldown> element. The <condition> element defines the condition for the action. The <link> element consumes the token to open the target destination.

Last modified on 29 October, 2020
Event Handler Reference   Customize Simple XML

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.11, 8.1.13, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2, 9.4.0, 8.1.10, 8.1.12, 8.1.14, 8.1.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters