Splunk Search

update eval token with first row of a dashboard table

nabeel652
Builder

I have two tables in a dashboard, The top one lists all the WAN links and the bottom one shows the detailed link utilisation over time when any device link in the top table is clicked.

I want the bottom table to update automatically with the first device (whatever in the top table is) using eval token so that it doesn't come up with "Search is waiting for input" message. The links in the upper table keep on changing so I cannot hard code the token in the bottom table to show a specific link every time the dashboard loads.

In short: On first page load the table at the bottom to show records related to whatever the wan-link is in the first row of the table at the top. Once dashboard has loaded it should be able to show upon clicking on any link in the top table.

Tags (3)
0 Karma
1 Solution

nabeel652
Builder

Well, done that the dirty way:

Created a dropdown and set its <selectFirstChoice>true</selectFirstChoice>

Then ran the same query that runs in the top table and the token for dropdown set with the first (top most) value. That token name is the same as the drilldown token in top table.

then set the input to hidden by depends="$somedummyvar$".

All good 🙂

View solution in original post

nabeel652
Builder

Well, done that the dirty way:

Created a dropdown and set its <selectFirstChoice>true</selectFirstChoice>

Then ran the same query that runs in the top table and the token for dropdown set with the first (top most) value. That token name is the same as the drilldown token in top table.

then set the input to hidden by depends="$somedummyvar$".

All good 🙂

paramagurukarth
Builder

Adding to this.. Instead of running the same search twice.. give an ID for that search and use that as the base search for you dropdown and table... so that the first result in the table and the dropdown(i.e, token) will be same in all scenarios

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...