Splunk Search

Why is chart drilldown not passing parameter?

claatu
Explorer

When I attempt to drilldown from a dashboard (line) chart to another dashboard (form), it seems like the parameter is not being passed on.

The chart is pretty simple, the query for it ends with:

... | table "Month" "NonCompliant"

So the X axis is each month and the Y axis is a count of NonCompliant things.
The drilldown is set as:

  <link target="_blank">/app/splunk_app_sa/noncompliants_for_period?thePeriod="$click.value$"</link>
</drilldown>

The idea is when I click on a node on that chart (say, for month 09/2018), that “09/2018” should get passed to the other dashboard as “thePeriod”.

The other dashboard, which works fine if you enter "thePeriod" manually, has:

<input type="text" token="thePeriod">
  <label>For Period (mm/yyyy)</label>
</input>

Clicking on the month node does bring up the other dashboard, but without providing the clicked-on month parameter.
I have tried “$click.name$”, "$click.value$", “$row.Month$”, etc, with and without quotes...

Any ideas?

0 Karma
1 Solution

renjith_nair
Legend

@claatu,

Prefix form token names with "form." if you are setting token values in a target form.

E.g.

/app/splunk_app_sa/noncompliants_for_period?form.thePeriod=$click.value$
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@claatu,

Prefix form token names with "form." if you are setting token values in a target form.

E.g.

/app/splunk_app_sa/noncompliants_for_period?form.thePeriod=$click.value$
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

claatu
Explorer

Can't believe I didn't see that. Thanks.

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...