The War Room • Room 3

Dashboard Tokens

**Tokens** are dynamic variables used in Splunk dashboards to pass values between input controls, panels, and drilldowns.

A common pattern: a dropdown sets `$selected_host$`, and all panels reference that token in their searches.

Tokens are defined in Simple XML using `<set token="name">value</set>`.

Token in Search

index=main host=$selected_host$ | stats count by sourcetype

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Write a search that uses a token called "$selected_index$" to dynamically set the index being queried.

Splunk Search Bar