Splunk Enterprise

Cannot send drilldown multiple tokens to other form input

altink
Builder

Hello

I am trying to drilldown a table dashboard to another form's several inputs, but I get the variable names instead of their values.

The main form - scan_data_02 - has (between others) a statistical table dashboard, whose records are present.

I have another form - scan_item_details_02 which has three simple text inputs and a table dashboard, which is bound in search to the three inputs. The search in this form works correctly by itself, the three inputs have default values, the table has data and it responds to every change in the three inputs.

scan_item_details_02:

<form>
  <label>Scan Item Details 02</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="text" token="field_scan_id">
      <label>Scan Id</label>
      <default>20170709_125008_Ora_DB_LV</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="text" token="field_vln_id">
      <label>Vln Id</label>
      <default>201</default>
    </input>
    <input type="text" token="field_db_name">
      <label>Database</label>
      <default>Oracle Live DB</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=omega_ds_idx_01 
DB_NAME=$field_db_name$ SCAN_ID=$field_scan_id$ VLN_ID=$field_vln_id$
| table  DB_NAME  SCAN_ID VLN_ID VLN_NAME .........</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="count">3</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

The URL of the correct standalone working of the detail form is:

http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_02?form.field_scan_id=20170709_125008_Ora_DB_LV&form.field_db_name=Oracle%20Live%20DB&form.field_vln_id=201

The problem starts when I drill-down from the main form "scan_data_02".

The dashboard and drill-down code is:

<panel>
      <table>
        <title>DRILL</title>
        <search>
          <query>index=........ 
| table  DB_NAME  SCAN_ID VLN_ID VLN_NAME .......</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">4</option>
        <drilldown target="blank">
          <link>scan_item_details_02?form.field_scan_id=$row.SCAN_ID&amp;form.field_vln_id=$row.VLN_ID&amp;form.field_db_name=$row.DB_NAME</link>
        </drilldown>
      </table>
    </panel>

Instead of having the three inputs completed with the three field values - I get $row.field_name on them - $row.SCAN_ID instead of the scan name. so for two others - by respective field

The error URL is:

http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_02?form.field_scan_id=%24row.SCAN_ID&form.field_vln_id=%24row.VLN_ID&form.field_db_name=%24row.DB_NAME

Please advise on the right command for drill-down

thank you very much,

best regards
Altin

0 Karma
1 Solution

altink
Builder

Fixed:
scan_item_details_02?form.field_scan_id=$row.SCAN_ID$&form.field_vln_id=$row.VLN_ID$&form.field_db_name=$row.DB_NAME$

forgot the $ at the end of field_name

View solution in original post

altink
Builder

Fixed:
scan_item_details_02?form.field_scan_id=$row.SCAN_ID$&form.field_vln_id=$row.VLN_ID$&form.field_db_name=$row.DB_NAME$

forgot the $ at the end of field_name

altink
Builder

The same does not work when the token input elements are removed and remaining only in the search of the target form.
no results are found - while there should be - as in the previous try with input elements involved.

Details for code is:

<form>
  <label>Scan Item Details 03</label>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>field1</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=omega_ds_idx_01 
DB_NAME=$form.field_db_name$ SCAN_ID=$form.field_scan_id$ VLN_ID=$form.field_vln_id$
| table DB_NAME SCAN_ID VLN_ID VLN_NAME CTRL_SUMMARY CTRL_OUTPUT</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="count">3</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

the input text field1 has been inserted just to have the tag of the form added

Problem:
The dashboard returns no rows: "No results found. "

The URL is:

http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_03?form.field_scan_id=20170714_...

The search should return data:

SCAN_ID=20170714_210278_Ora_DB_T01
VLN_ID=204
DB_NAME="Ora DB Test01"

index=omega_ds_idx_01 SCAN_ID=20170714_210278_Ora_DB_T01
VLN_ID=204 
DB_NAME="Ora DB Test 01"

does return

from the following Ticket:

https://answers.splunk.com/answers/219807/how-to-hide-a-dashboard-panel-containing-inputs-th.html

do I have to read that the drill-down at target form (dashboard) - is not supported without visual Input elements in the middle?
if not - please advise on how to do without input elements

best regards
Altin

0 Karma

altink
Builder

Fixed:
scan_item_details_02?form.field_scan_id=$row.SCAN_ID$&form.field_vln_id=$row.VLN_ID$&form.field_db_name=$row.DB_NAME$

forgot the $ at the end of field_name

0 Karma

niketn
Legend

@altink, please convert your comment to answer and accept the same to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...