Tokens

A token represents a value that can change, such as a user's selection from a dropdown. You can use tokens to access and pass these values to create more interactive and dynamic dashboards. For example, you can use a token value to filter data from a data source, in a visualization title, or to control panel visibility.

Tokens can be set in the following ways:

Inputs: inputs such as a dropdown or text input have an associated token, which you can then use in other dashboard components.
Visualizations: you can configure a dashboard with a set token interaction. When the dashboard viewer clicks the visualization, this sets the associated token value. See Setting tokens on a visualization click.
From search results or metadata. See Setting tokens from search results or search job metadata.
By environmental factors. See Embed user and environment details with environment tokens.

When using tokens, you may want to define default token values to ensure that dashboards do not initially display empty visualizations. See Defaults for tokens.

Token filters

Token filters ensure that you correctly capture the token value.


Filter	Description
Wrap value in quotes $token_name\|s$	Ensures that quotation marks surround the value that the token references. Escapes all quotation characters, `"`, within the quoted value.
HTML format $token_name\|h$	Ensures that the token value is valid for HTML formatting. Token values for the <HTML> element use this filter by default.
URL format $token_name\|u$	Ensures that the token value is valid to use as a URL. Token values for the <link> element use this filter by default.
Specify no character escaping $token_name\|n$	Prevents the default token filter from running. No characters in the token are escaped.

The following code snippet uses the |s filter to place quotation marks around the value returned from a token:

   "dataSources": {
        "ds_ogwSvnl1": {
            "name": "Token search",
            "options": {
                "query": "index=_internal sourcetype=$sourcetype_tok|s$ | timechart count by sourcetype"
            },
            "type": "ds.search"
        }
    }

If the value of sourcetype_tok is access_combined, it builds the following search string:

index=_internal sourcetype="access_combined" | timechart count by sourcetype