Splunk Search

How to pass fields as tokens from one panel to other panels on the same dashboard?

clintla
Contributor

Not finding any examples so far, but not sure if it's possible.

Wanting to have one dashboard panel that has a result, say 4 values in FIELD1, & then I want to use all the values found & pass to all the other dashboard panels as a token to search for.

It would even be cool to click on a value in FIELD1 & then have it populate to the rest of the dashboards.

Is this possible & straight forward to do?

1 Solution

somesoni2
SplunkTrust
SplunkTrust

What you seek is called Contextual drilldown OR IN-page drilldown in Splunk. See following link for details and working sample.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/Understandbasictableandchartdrilldownactions#C...

You can also see the it's example in Drilldown section of the Splunk 6 Dashboard Example App.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What you seek is called Contextual drilldown OR IN-page drilldown in Splunk. See following link for details and working sample.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/Understandbasictableandchartdrilldownactions#C...

You can also see the it's example in Drilldown section of the Splunk 6 Dashboard Example App.

0 Karma

sundareshr
Legend

You can either have the 4 values in a dropdown or in a Link List.

Start here: http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Define_tokens_for_form_inputs

If this doesn't help, share your dashboard code

0 Karma

clintla
Contributor

All this info was great.. got it all working.. thanks!

0 Karma

snoobzilla
Builder

In short, yes, it is possible. I have dashboards where you click on any of 3 charts/tables to select what is broken out in another 2 panels.

The documentation provided above should get you started. There is a learning curve... but not too bad. I would take a look at the Splunk example dashboards too.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...