Splunk Dashboard Child Elements: Eval
In Splunk, there are a number of child elements available. Splunk dashboard generally contains multiple parent and child tags to build an XML. Where <dashboard> or <form> is the root element. Today we will discuss <eval> tag child elements. For example, we can use a child element <panel> under a parent element <row> to build multiple panes within one row.
These are the parent elements where <eval> tag can be used.
<drilldown><condition> <search><condition> <change><condition>
Example and Format:
<drilldown> <eval token="[token_name]"></eval> </drilldown>
<drilldown> <condition> <eval token="[token_name]"></eval> </condition> </drilldown>
<change> <eval token="[token_name]"></eval> </change>
<change> <condition> <eval token="[token_name]"></eval> </condition> </change>
<search> <condition> <eval token="[token_name]"></eval> </condition> </search>
<search> <eval token="[token_name]"></eval> </search>
Example and format:
Eval tag can be used to execute an eval operation and save that result in a token, which we can use in our later phases. It is pretty similar to the SPL eval command in some places.
Here we have a text input from lines 4 to 11 and I have a single value panel from lines 14 to 23.
From lines 7 to 10 I created a change tag which is the parent tag for <eval> child elements here. Within that, I set a token “newone” which is nothing but value coming from the text input that’s why I have used the same token there. After that at line number 9, I have used a <eval>, where I applied a case function that is pretty much the same as the normal SPL eval case function. There I stated that if the text input value is “*” then it should carry “all values” otherwise it should carry “else should be printed here”. Then within the single value viz I added the token coming from the eval tag.
Then Dashboard will look like this.
Here I have used the eval tag within the <input> you can use within the <drilldown> also.
Take a look at this blog below to check how we can pass the <eval> tag within a <drilldown>.
Also, I mentioned a few classic use cases of the <eval> tag.
I hope you have enjoyed this blog “Splunk Dashboard Child Elements: Eval“, see you all on to the next one.