Dashboards & Visualizations

How do you pass a single value to a drilldown to open another dashboard?

ruchijain
New Member

HI,

I want to pass the single value into a drilldown. I tried two options, but nothing has worked.

Please help me in this:

  1. I tried to click on the single value, and then on the same dashboard below table populates the details of the source.
  2. List item

Code is:

<dashboard>
  <label>TV Dashboard</label>
  <description>Starting...</description>
  <row id="allpage_row1">
    <panel>
      <single>
        <search>
          <query>index=metroday source="tcscheck.sh" STATUS=UP raxtype=* | dedup host | stats count(STATUS) as COUNT | rangemap field=COUNT low=12-99 elevated=9-11 severe=0-8</query>
          <earliest>-3m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="underLabel">TCS</option>
        <option name="refresh.auto.interval">120</option>
        <option name="refresh.time.visible">false</option>
        <option name="link.visible">false</option>
        <option name="classField">range</option>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="source">$row.source$</set>
         <set token="table.source">$row.source$</set> 
        </drilldown>
      </single>
  </panel>
  </row>
  <row>
    <panel depends="$source$">
      <title>Source details</title>
      <table>
        <search>
          <query>index = metroday source=$source$
            | table host, count </query>
        <earliest>-7d</earliest>
        <latest>-0d</latest>
      </search>
      </table>
    </panel>
  </row>
</dashboard>
  1. I have used is clicking on this dashboard and opens a new dashboard:

Source is:

<search>
          <query>source="httppinger.sh" host=*JBO* SUCCESS | chart distinct_count(host) as COUNT | rangemap field=COUNT low=6-10 severe=0-5</query>
          <earliest>-7m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="underLabel">Browser</option>
        <option name="refresh.auto.interval">180</option>
        <option name="refresh.time.visible">false</option>
        <option name="link.visible">false</option>
        <option name="classField">range</option>
        <drilldown taregt="blank">
          <link>tv_dashboard_drilldown?dashboard.hosttok=$click.value$</link>
        </drilldown>
      </single>`


Target code is: `<panel>
  <form>
  <label>Target dashboard for drilldown</label>
    <row>
       <table id="detail" depends="$source$">
        <query>index = metroday source=$source$
            | table host, count, source | dedup host</query>
          <earliest>-7d</earliest>
          <latest>-0d</latest>
        </table>
      </row>
    </form>  
    </panel>`

But nothing is working.

I am interested in a second option where I clicked on the number and it opens a new dashboard and passes the value to it.

My source dashboard will look like the attachment where when I click on the number 3, it will open new dashboard and create the table that contains the details of all the 3 sourcetypes.
alt text

Tags (2)
0 Karma
1 Solution

DMohn
Motivator

You are referencing to a different token name than the one passen in the link...

<link>tv_dashboard_drilldown?dashboard.hosttok=$click.value$</link> here you are setting a parameter dashboard.hosttok to be available to the target dashboard. But your qurey on the target is <query>index = metroday source=$source$| table host, count, source | dedup host</query>, where you aren't accessing the token at all.

Your target query needs to reference $dashboard.hosttok$ as well.

View solution in original post

0 Karma

DMohn
Motivator

You are referencing to a different token name than the one passen in the link...

<link>tv_dashboard_drilldown?dashboard.hosttok=$click.value$</link> here you are setting a parameter dashboard.hosttok to be available to the target dashboard. But your qurey on the target is <query>index = metroday source=$source$| table host, count, source | dedup host</query>, where you aren't accessing the token at all.

Your target query needs to reference $dashboard.hosttok$ as well.

0 Karma

ruchijain
New Member

Hi DMohn,

Thanks for replying that. I tried the below changes but still there is no data:

Source code: 
 <single>
        <search>
          <query>source="httppinger.sh" host=*JBO* SUCCESS | chart distinct_count(host) as COUNT | rangemap field=COUNT low=6-10 severe=0-5</query>
          <earliest>-7m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="underLabel">Browser</option>
        <option name="refresh.auto.interval">180</option>
        <option name="refresh.time.visible">false</option>
        <option name="link.visible">false</option>
        <option name="classField">range</option>
        <option name="drilldown">all</option>
        <drilldown>
          <link target="_blank">/app/ruchiapps/tv_dash_drill?sourcetok=$click.value$</link>
        </drilldown>
      </single>

Destination code: 
<dashboard>
  <label>TV Drilldown Dashboard</label>
  <description>Providing details on TV Dashboard object $sourcetok$</description>
  <row id="page1_row1">
<panel>
  <form>
       <table id="detail" depends="$sourcetok$">
        <query>index = metroday source=$sourcetok$
            | table host, count, source | dedup host</query>
          <earliest>-7d</earliest>
          <latest>-0d</latest>
        </table>
     </form>  
    </panel>
    </row>
</dashboard>

I want from my previous picture that when i clicked on number 3 it will pass to another dashboard and that number 3 will display there and below there will be table which will display the details of all the three sources...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...