Dashboards & Visualizations

How to token transfer from one dashboard to another?

mbasharat
Contributor

I have two dashboards. Dashboard A and Dashboard B.

I have a table with filed name SERVER in Dashboard A. I want o pass on SERVER value from Dashboard A into the SERVER value text box in Dashboard B.

This is for drill down from A to B. I have drill down as "Link to Dashboard". When SERVER value is clicked in Dashboard A, it should take me to Dashboard B with "clicked" SERVER inserted into SERVER value text box in Dashboard B.

How do I do this?

Thanks

0 Karma
1 Solution

niketn
Legend

@mbasharat Splunk Dashboard Examples App has an example for this particular scenario of passing Token from Source Dashboard to Destination as Form Token. Please download and try out the example.

Following is the kind of code you would need:

    <drilldown>
      <link target="_blank">/app/<yourSplunkAppName>/<yourDestinationDashboardName>?form.<yourTextBoxTokenNameInDestinationDashboard>=$row.SERVER$</link>
    </drilldown>

alt text

Following is a run anywhere example for source and destination dashboard based on Splunk's _internal index created under default search app (you would need to keep dashboard name as per the example to try them out)

Source Dashboard (source_dashboard_to_pass_component.xml)

<dashboard>
  <label>Source Dashboard To Pass Component</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| top 5 component showperc=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">/app/search/destination_dashboard_to_use_component?form.tokComponent=$row.component$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Destination Dashboard (destination_dashboard_to_use_component.xml)

<form>
  <label>Destination Dashboard to Use Component</label>
  <fieldset submitButton="false">
    <input type="text" token="tokComponent" searchWhenChanged="true">
      <label>Filter Component</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO component="$tokComponent$"
| timechart count by component useother=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@mbasharat Splunk Dashboard Examples App has an example for this particular scenario of passing Token from Source Dashboard to Destination as Form Token. Please download and try out the example.

Following is the kind of code you would need:

    <drilldown>
      <link target="_blank">/app/<yourSplunkAppName>/<yourDestinationDashboardName>?form.<yourTextBoxTokenNameInDestinationDashboard>=$row.SERVER$</link>
    </drilldown>

alt text

Following is a run anywhere example for source and destination dashboard based on Splunk's _internal index created under default search app (you would need to keep dashboard name as per the example to try them out)

Source Dashboard (source_dashboard_to_pass_component.xml)

<dashboard>
  <label>Source Dashboard To Pass Component</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| top 5 component showperc=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">/app/search/destination_dashboard_to_use_component?form.tokComponent=$row.component$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Destination Dashboard (destination_dashboard_to_use_component.xml)

<form>
  <label>Destination Dashboard to Use Component</label>
  <fieldset submitButton="false">
    <input type="text" token="tokComponent" searchWhenChanged="true">
      <label>Filter Component</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO component="$tokComponent$"
| timechart count by component useother=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mbasharat
Contributor

Great. This is exactly what I needed. THANK YOU!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

This is a very basic Splunk simple xml drilldown use-case. See this for how to implement it

http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/DrilldownLinkToDashboard#Example_source_code

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...