Splunk® Enterprise

Splunk Dashboard Studio

Embed user and environment details with environment tokens

Use environment tokens to embed details about the user and their Splunk platform instance within the dashboard. You can read environment token data but not write environment token data. For example, you can't modify environment tokens with dashboard interactivity features such as inputs or drilldowns. Additionally, scheduled PDF exports do not support environment tokens.

The following are possible use cases for environment tokens:

  • Visualization titles, labels, or text
  • Input labels
  • Search queries
  • Dashboard titles and descriptions

Environment tokens

Apply environment tokens using the token syntax $env:<option>$. The following environment tokens are available for use within dashboards.

Name Description
$env:user$ Current user's username
$env:user_realname$ Current user's full name
$env:user_email$ Current user's email address
$env:user_timezone$ Resolves the timezone to the user's preferred timezone. The token resolves to the default system timezone or the localized equivalent if the user doesn't specify a timezone.
$env:app$ Current app context
$env:locale$ Current locale
$env:page$ Current open page
$env:product$ Current instance's product type
$env:instance_type$ Indicates if the current instance is a Splunk Cloud Platform (SCP) deployment. This token is only set when "true" and only operates for SCP.
$env:is_cloud$ Indicates if the current instance is Splunk Cloud Platform. This token is only set when "true".
$env:is_enterprise$ Indicates if the current instance is a Splunk Enterprise deployment. This token is only set when "true".
$env:is_lite_free$ Indicates if the current instance is using a Splunk Light free license. This token is only set when "true".
$env:is_free$ Indicates if the current instance is using a Splunk Enterprise free license. This token is only set when "true".
$env:version$ Current instance's product version

Example of using environment tokens

The following example uses environment tokens in the title of an area chart to welcome the user and inform them of the product, version, and application they are using. Next to the area chart is a Markdown visualization with a short summary of the same information using environment tokens.

An area chart using environment tokens in its title and showing a user's activity in the search application over the last 60 minutes. A Markdown visualization using environment tokens to show the user's details such as username, platform, application, and version.

Source code

The following is the source code for the example screenshot that shows how to use environment tokens in the title of an area chart and a Markdown visualization.

{
  "visualizations": {
    "viz_JMX4VZ6S": {
      "type": "splunk.markdown",
      "options": {
        "markdown": "# User profile\n\n## Name\n$env:user_realname$\n\n## Username\n$env:user$\n\n## Product \n$env:product$\n\n## Version\n$env:version$\n\n## Application\n$env:app$ app",
        "backgroundColor": "#ffffff"
      }
    },
    "viz_p35wYSFE": {
      "type": "splunk.area",
      "dataSources": {
        "primary": "ds_PmcxBWwC"
      },
      "title": "Hello, $env:user_realname$! Here's your activity while using $env:product$ version $env:version$ of the $env:app$ application."
    }
  },
  "dataSources": {
    "ds_Vn8PZwMa": {
      "type": "ds.search",
      "options": {
        "query": "| makeresults \n"
      },
      "name": "Search_1"
    },
    "ds_PmcxBWwC": {
      "type": "ds.search",
      "options": {
        "query": "index=_internal user=$env:user$ | timechart count"
      },
      "name": "Search_2"
    },
    "ds_cSYPttpl": {
      "type": "ds.search",
      "options": {
        "query": "index=_internal user=$env:user$ | timechart count"
      },
      "name": "Search_3"
    }
  },
  "defaults": {
    "dataSources": {
      "ds.search": {
        "options": {
          "queryParameters": {
            "latest": "$global_time.latest$",
            "earliest": "$global_time.earliest$"
          }
        }
      }
    }
  },
  "inputs": {
    "input_global_trp": {
      "type": "input.timerange",
      "options": {
        "token": "global_time",
        "defaultValue": "-24h@h,now"
      },
      "title": "Global Time Range"
    }
  },
  "layout": {
    "type": "absolute",
    "options": {
      "display": "auto-scale"
    },
    "structure": [
      {
        "item": "viz_JMX4VZ6S",
        "type": "block",
        "position": {
          "x": 750,
          "y": 50,
          "w": 190,
          "h": 400
        }
      },
      {
        "item": "viz_p35wYSFE",
        "type": "block",
        "position": {
          "x": 30,
          "y": 20,
          "w": 690,
          "h": 450
        }
      }
    ],
    "globalInputs": [
      "input_global_trp"
    ]
  },
  "description": "",
  "title": "Environment Tokens"
}
Last modified on 13 March, 2023
Setting tokens from search results or search job metadata   Conditionally show or hide panels

This documentation applies to the following versions of Splunk® Enterprise: 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters