Dashboards & Visualizations

Can you use a token from one dashbaord in another dashboard that's linked to it?

madisonf15
Engager

I have two simple xml dashbaords: a high level dashbord and a low level dashbaord. I have 4 filters on the high level (system code filter, subsystem filter, time range filter, and a call type filter) that affect all of the panels. You can get to the low level dashbaord by clicking on a single-value panel on the high level. I'm using the token "$syscode_tok$" to reference the single value (let's say it's -513) in my low level dashboard. So whenever I want to extract data that contains the single-value -513 in my low level dhasboard, I just use my $syscode_tok$. However, I was wondering if there was a way to reference the other 4 filters I have on my high-level. I tried setting the default on my low level to be the $syscode_tok$, but that just gives me the -513. Is there a way to get the 4 tokens I have on my high level to my low level?

Tags (1)
0 Karma

kbarker302
Communicator

Are you trying to achieve something like this? I only have two dropdowns in my example, but the key is the link statement in the drilldown for the single value:

<form>
  <label>Dashboard - Link to second dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <choice value="1">Choice 1</choice>
      <choice value="2">Choice 2</choice>
      <choice value="3">Choice 3</choice>
      <default>1</default>
    </input>
    <input type="dropdown" token="field2">
      <choice value="1">Choice 1</choice>
      <choice value="2">Choice 2</choice>
      <choice value="3">Choice 3</choice>
      <default>1</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_audit | stats count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <link>/app/sandbox/second_dashboard?field1=$field1$&amp;field2=$field2$</link>
        </drilldown>
      </single>
    </panel>
  </row>
</form>

Then in the "receiving" or low level dashboard, you should be able to reference the tokens passed on the query string:

<dashboard>
  <label>Second Dashboard</label>
  <row>
  <html>
    <div>
      Field 1: $field1$<br/>
      Field 2: $field2$
    </div>
  </html>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...