I currently have a dashboard that displays a bunch of nodes (for example, Firewall1). When I click on that node, it drills down to a dashboard that contains a bunch of metrics, such as response time and CPU usage. As of right now, every node on the main dashboard links to the same secondary one, which has a drop down list to filter all the queries for the metrics by the node that you want to look at. Instead of have this done manually, is there a way to where when I click on Firewall1 and get send to the dashboard with the metrics, I can pass the Node Name value (which would be "Firewall1") into the other dashboard's queries so that they automatically load the metrics for Firewall1?
Hi @SudeepDell,
You could use form.token_name to pass the parameter. See below example
Main Dashboard with node (sourcetype in my case)
<dashboard>
<label>DrillDown</label>
<row>
<panel>
<single>
<search>
<query>|stats count|eval node="splunkd"|fields - count</query>
<earliest>-1s</earliest>
<latest>now</latest>
</search>
<option name="drilldown">all</option>
<drilldown>
<link target="_blank">/app/search/metric?form.node=$click.value2$</link>
</drilldown>
</single>
</panel>
</row>
</dashboard>
Drilldown dashboard with metrics
<form>
<label>Metric</label>
<fieldset submitButton="false">
<input type="dropdown" token="node">
<label>Node</label>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=_* sourcetype=$node$|timechart span=1m count</query>
<earliest>-5m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</form>
@SudeepDell, did it work for you?