Splunk Search

Drilldown from lookup populated dropdown

richkappler
Path Finder

I have a dashboard dropdown that I'm populating with "groups" from a lookup "group_ip_host". The idea is to have the user choose a group that takes the user, carrying the $group_tok$, to another dashboard that is generic to any group and does stuff based on the value of $group_tok$.

The dropdown is populating. I can see $group_tok$ being populated in the URL bar (notenoughkarmatopostalink/rpa_clone?form.group_tok=HR). I have verified that the "drilldown" dashboard is available and works given a $group_tok$, but making the selection on the top level dash doesn't take you to the drilldown. Here's my fieldset, what am I missing?

  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="group_tok" searchWhenChanged="true">
      <label>Bot Category</label>
      <search>
        <query>
          | inputlookup group_ip_host
          | dedup group
          | table group
        </query>
      </search>
      <fieldForLabel>group</fieldForLabel>
      <fieldForValue>group</fieldForValue>
      <change>
        <condition label="group">
          <link target="_blank">
            <![CDATA[/app/XXXXX/drilldown1?group=$group_tok$]]>
          </link>
        </condition>
      </change>
    </input>
  </fieldset>
0 Karma
1 Solution

vnravikumar
Champion

Hi @richkappler

Please check this

<form>
  <label>navigation</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="group_tok" searchWhenChanged="true">
      <label>Bot Category</label>
      <fieldForLabel>group</fieldForLabel>
      <fieldForValue>group</fieldForValue>
      <change>
        <condition label="group">
          <link target="_blank">
            <![CDATA[/app/search/seconddashboard?form.param=$group_tok$]]>
          </link>
        </condition>
      </change>
      <choice value="group">group</choice>
    </input>
  </fieldset>

</form>


Second dashboard:
<form>
  <label>seconddashboard</label>
  <fieldset submitButton="false">
    <input type="text" token="param">
      <label>Dropdown Value</label>
    </input>
  </fieldset>
</form>

View solution in original post

richkappler
Path Finder

Further information: @vnravikumar - running your code as written does indeed work as a standalone, however, when I add in the search to populate the lookup instead of hardcoding choice, it does not work. Here are the 2 pieces of xml:
This works:

    <form>
       <label>navigation</label>
       <fieldset autoRun="true" submitButton="false">
         <input type="dropdown" token="group_tok" searchWhenChanged="true">
           <label>Bot Category</label>
          <fieldForLabel>group</fieldForLabel>
          <fieldForValue>group</fieldForValue>
           <change>
             <condition label="group">
               <link target="_blank">
                 drilldown1?form.param=$group_tok$
               </link>
             </condition>
           </change>
           <choice value="group">group</choice>
         </input>
       </fieldset>
    </form>

This does NOT work:

        <form>
           <label>navigation</label>
           <fieldset autoRun="true" submitButton="false">
             <input type="dropdown" token="group_tok" searchWhenChanged="true">
              <label>Bot Category</label>
              <!-- Dynamic definition of choices -->
              <search>
                <query>
                  | inputlookup group_ip_host
                  | dedup group
                  | table group
                </query>
              </search>
              <fieldForLabel>group</fieldForLabel>
              <fieldForValue>group</fieldForValue>
               <change>
                 <condition label="group">
                   <link target="_blank">
                     drilldown1?form.param=$group_tok$
                   </link>
                 </condition>
               </change>
             </input>
           </fieldset>
        </form>

You will please note that the only difference is choice is removed and the search is added. As before, I can see, in the url bar, that the $group_tok$ is picking up the dropdown selection, but the new tab is not opening. The search is not providing a choice to the change stanza.

0 Karma

vnravikumar
Champion

Hi @richkappler

Please check this

<form>
  <label>navigation</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="group_tok" searchWhenChanged="true">
      <label>Bot Category</label>
      <fieldForLabel>group</fieldForLabel>
      <fieldForValue>group</fieldForValue>
      <change>
        <condition label="group">
          <link target="_blank">
            <![CDATA[/app/search/seconddashboard?form.param=$group_tok$]]>
          </link>
        </condition>
      </change>
      <choice value="group">group</choice>
    </input>
  </fieldset>

</form>


Second dashboard:
<form>
  <label>seconddashboard</label>
  <fieldset submitButton="false">
    <input type="text" token="param">
      <label>Dropdown Value</label>
    </input>
  </fieldset>
</form>

richkappler
Path Finder

I see and understand the changes that you suggested, though I'm confused as to why there are 2 forms on one page, am I missing something?

Regardless, this did not work. the group only added, as one would expect, a choice of "group" to the dropdown, which I do not want.

The search is not in your code, so there is nothing to populate the dropdown with except the above-mentioned "group"

0 Karma

vnravikumar
Champion

Updated above, the second form is another dashboard. I had created under the search app. For sample purpose, I had added only one value to dropdown as group.

0 Karma

richkappler
Path Finder

This did not work. I've built literally dozens of drilldowns to dashboards that read an pass tokens, this is the first time I have populated the dropdown with a lookup, I don't know if that's relevant. It would appear that the $group_tok$ that is being generated by making a choice from the dropdown is not being passed to the stanza. Can't figure out why. If I hard code it, it works, even passing tokens from the dropdown to and from one dash to another.

0 Karma

richkappler
Path Finder

missing from above: for some reason the xml phrase I put in did not publish, should have read -> "making a choice from the dropdown is not beingpassed to the change stanza" and "passing tokens from the dropdown to change and from one dash to another."

0 Karma

vnravikumar
Champion

Try with

<change>
         <condition>
           <link target="_blank">
             <![CDATA[/app/XXXXX/drilldown1?group=$group_tok$]]>
           </link>
         </condition>
       </change>
0 Karma

vnravikumar
Champion

Try with condition like above and let me know.

0 Karma

richkappler
Path Finder

No, that was the original non-working code I posted. Tried again just to be sure, makes no difference. I had verified the functionality of not using CDATA before I posted it.

0 Karma

vnravikumar
Champion

Remove label="group" in condition tag

0 Karma

richkappler
Path Finder

Winner Winner Chicken Dinner, that did the trick, thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...