Since the Splunk PDF export doesnt apply token values to the dashboard before exporting we need to map and apply the token values manually.
For this purpose we implemented a parameter that accepts a JSON string that it is used to map the token values with the fields in the alert search that contains those values.
Lets say we have a dashboard that uses a token for selecting users and other token for selecting a time range.
Lets call the tokens tk_user and tk_time. Now the alert search should return those values in the result fields so we can map the tokens with the field values.
Since we used the timepicker input we have to map the tk_time.earliest and the tk_time.latest as those are the tokens that will be used in the dashboard.
The Tokens parameter should be configured like this: {"tk_user":"user", "tk_time.earliest":"info_min_time","tk_time.latest":"info_max_time"}
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.