How many tokens can I pass from one panel to another? Below is my thinking, but not sure if I am right?
panel 1 is a table with 3 values I want to pass to panel 2:
<drilldown>
<set token="mytoken">$click.name$</set>
<set token="mytoken2">$click.name2$</set>
<set token="mytoken3">$click.value$</set>
</drilldown>
This is panel 2 which receives these tokens:
<row>
<panel depends="$mytoken$" depends="$click.name2$" depends="$click.value$">
<chart>
....
</chart>
</panel>
</row>
think this is what i am looking for from here
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/tokens
Token Description
click.name Name of the leftmost field that appears in the table. This is always _time, if present.
click.value Value of the leftmost column in the row.
click.name2 Name of the column.
click.value2 Value of the column.
row. All field values for the table row, including those fields that are not displayed.
earliest/latest Time range of the table row, or if not applicable, the time range of the search.
Could you expand on passing rows?
@exocore123, you can use Field Names for the columns which are displayed in the table. Following is a run anywhere search using Splunk's _internal index. For example for log_level I have used $row.log_level$.
PS: for _time which is the first column in my result, it can also be accessed by $click.name$, as stated in the document or with $row._time$ as well
<row>
<panel>
<table>
<search>
<query>index="_internal" sourcetype="splunkd" log_level!="INFO"
| bin span=1h _time
| stats count by _time log_level component</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="log_level">$row.log_level$</set>
<set token="component">$row.component$</set>
<set token="count">$row.count$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel depends="$log_level$,$component$,$count$">
<title>$log_level$ $component$ $count$</title>
<chart>
</chart>
</panel>
</row>
I don't think so there is any documented limit on the drilldown tokens. You can setup the drilldown level at row level, if it's a table and then can use either $click.*$ tokens OR "$row.$ token that can be passed. See the drilldown section from below link to find possible tokens that can be set/passed.
http://docs.splunk.com/Documentation/Splunk/5.0/Viz/PanelreferenceforSimplifiedXML
think this is what i am looking for from here
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/tokens
Token Description
click.name Name of the leftmost field that appears in the table. This is always _time, if present.
click.value Value of the leftmost column in the row.
click.name2 Name of the column.
click.value2 Value of the column.
row.<fieldname> All field values for the table row, including those fields that are not displayed.
earliest/latest Time range of the table row, or if not applicable, the time range of the search.