Dashboards & Visualizations

Can you use a token from one dashbaord in another dashboard that's linked to it?

madisonf15
Engager

I have two simple xml dashbaords: a high level dashbord and a low level dashbaord. I have 4 filters on the high level (system code filter, subsystem filter, time range filter, and a call type filter) that affect all of the panels. You can get to the low level dashbaord by clicking on a single-value panel on the high level. I'm using the token "$syscode_tok$" to reference the single value (let's say it's -513) in my low level dashboard. So whenever I want to extract data that contains the single-value -513 in my low level dhasboard, I just use my $syscode_tok$. However, I was wondering if there was a way to reference the other 4 filters I have on my high-level. I tried setting the default on my low level to be the $syscode_tok$, but that just gives me the -513. Is there a way to get the 4 tokens I have on my high level to my low level?

Tags (1)
0 Karma

kbarker302
Communicator

Are you trying to achieve something like this? I only have two dropdowns in my example, but the key is the link statement in the drilldown for the single value:

<form>
  <label>Dashboard - Link to second dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <choice value="1">Choice 1</choice>
      <choice value="2">Choice 2</choice>
      <choice value="3">Choice 3</choice>
      <default>1</default>
    </input>
    <input type="dropdown" token="field2">
      <choice value="1">Choice 1</choice>
      <choice value="2">Choice 2</choice>
      <choice value="3">Choice 3</choice>
      <default>1</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_audit | stats count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <link>/app/sandbox/second_dashboard?field1=$field1$&amp;field2=$field2$</link>
        </drilldown>
      </single>
    </panel>
  </row>
</form>

Then in the "receiving" or low level dashboard, you should be able to reference the tokens passed on the query string:

<dashboard>
  <label>Second Dashboard</label>
  <row>
  <html>
    <div>
      Field 1: $field1$<br/>
      Field 2: $field2$
    </div>
  </html>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...