Dashboards & Visualizations

How do I pass the current form values to a drilldown link

chapa
Explorer

I have a dataset that has multiple attributes:
accountNumber, deviceNumber, eventName, status

I built a dashboard with 4 panels each showing "chart count by x" for each of the 4 attributes.

I want to allow to user to click on a value in the panel to filter the dashboard on that value, but I also want them to compound. So in order to do so, I have to pass, not only the click.value, but also each of the form's current values like this:

<drilldown>
  <link>
    <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$form.deviceNumber$&form.eventName=$form.eventName$&form.status=$form.status$&form.timePicker.earliest=$form.timePicker.earliest$&form.timePicker.latest=$form.timePicker.latest$&earliest=0&latest=]]>
  </link>
</drilldown>

which is kind of a pain.

Is there a way to send a single form.values or token that would pass all the form's current values so I can shorten the link to this:

 <drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.allValues=$form.allValues$]]>
   </link>
 </drilldown>
0 Karma

jkat54
SplunkTrust
SplunkTrust

There is a way but it's not pretty.

You could eval mvzip them all together in search strings or otherwise create a multi value field with all the drop down values. Then put that field in a table for the user to click. Then when they clicked, the multi valued token would go through the drill down and you could use eval mvindex to extract the individual tokens back out.

You might also be interested in this:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

There's a subsection on using mv fields in drill downs.

0 Karma

somesoni2
Revered Legend

AFAIK, there is no such option in simple xml. Although, you can remove some $form. prefix for local tokens, making little better

<drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$deviceNumber$&form.eventName=$eventName$&form.status=$status$&form.timePicker.earliest=$timePicker.earliest$&form.timePicker.latest=$timePicker.latest$]]>
   </link>
 </drilldown>
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...