Dashboards & Visualizations

Are tokens what I need to use in order to submit different drilldown searches based on what the user clicks on a trellised visualization?

williamcharlton
Path Finder

I can't make heads nor tails of the Splunk docs for Token usage in dashboards

I have an index foo. Events in this index have a field bar that has one of two values: True or False

I have a dashboard with a panel that has a trellised (is split by bar), single value visualization. The search is index=foo | stats count by bar.

My goal is when the user clicks on the value under False, I want to open a new tab and run the drilldown search index=foo bar = "False", and when the user clicks on the value under True, I want to open a new tab and run the drilldown search index=foo bar = "True"

If tokens are what I need for my drilldown searches, how do I use them to accomplish my goal?

0 Karma

niketn
Legend

@williamcharlton0028 for trellis Splunk has provided two pre-defined drilldown tokens i.e. $trellis.name$ and $trellis.value$. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/SplunkLight/latest/GettingStarted/Visualizationtrellis#Predefi...

You can also refer to one of my older answers for run anywhere example for $trellis.value$ : https://answers.splunk.com/answers/551802/how-can-i-get-drill-down-working-for-a-trellis-cha.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

Token usage can be very confusing for the beginner. Here are 2 tips:
1: As much as possible, use the GUI.
2: Explore the Splunk Dashboard Exmaples app: https://splunkbase.splunk.com/app/1603/

0 Karma

aohls
Contributor

You will want to use tokens with a click event. Below is a good starting point. You will need to edit the xml.

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown

0 Karma

williamcharlton
Path Finder

As I mentioned in my question, I don't understand the docs on this topic. Perhaps you could provide an example that includes info concerning what dashboard element I need to edit. For example, your answer says "You will need to edit the xml." What XML? Where ? The docs are most unhelpful in this regard

0 Karma

aohls
Contributor

You actually might not need to edit the xml depending on what you want to do. In your panel on the three dots you can select Edit Drilldown, next to the trellis. You would then want to link either to a report, dashboard or search of your choice. In this area you would connect the link and then the tokens you want to pass.

I have only linked dashboards and takes a bit of testing to get what you want potentially. Yours might look something like the following:

<drilldown>
          <set token="boolean">$click.name2$</set>
          <link target="_blank">search?q=index=foo bar=$boolean$</link>
        </drilldown>
      </chart>
    </panel>

When you click you set boolean to true or false; you might need to edit the "click.name*" see: https://docs.splunk.com/Documentation/Splunk/7.3.1/Viz/PanelreferenceforSimplifiedXML#Predefined_dri....

Then you pass the boolean value to the search in the target.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...