Re: Can you use a token from one dashbaord in anot...

madisonf15 · ‎07-28-2016

I have two simple xml dashbaords: a high level dashbord and a low level dashbaord. I have 4 filters on the high level (system code filter, subsystem filter, time range filter, and a call type filter) that affect all of the panels. You can get to the low level dashbaord by clicking on a single-value panel on the high level. I'm using the token "$syscode_tok$" to reference the single value (let's say it's -513) in my low level dashboard. So whenever I want to extract data that contains the single-value -513 in my low level dhasboard, I just use my $syscode_tok$. However, I was wondering if there was a way to reference the other 4 filters I have on my high-level. I tried setting the default on my low level to be the $syscode_tok$, but that just gives me the -513. Is there a way to get the 4 tokens I have on my high level to my low level?

kbarker302 · ‎07-28-2016

Are you trying to achieve something like this? I only have two dropdowns in my example, but the key is the link statement in the drilldown for the single value:

<form>
  <label>Dashboard - Link to second dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <choice value="1">Choice 1</choice>
      <choice value="2">Choice 2</choice>
      <choice value="3">Choice 3</choice>
      <default>1</default>
    </input>
    <input type="dropdown" token="field2">
      <choice value="1">Choice 1</choice>
      <choice value="2">Choice 2</choice>
      <choice value="3">Choice 3</choice>
      <default>1</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_audit | stats count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <link>/app/sandbox/second_dashboard?field1=$field1$&amp;field2=$field2$</link>
        </drilldown>
      </single>
    </panel>
  </row>
</form>

Then in the "receiving" or low level dashboard, you should be able to reference the tokens passed on the query string:

<dashboard>
  <label>Second Dashboard</label>
  <row>
  <html>
    <div>
      Field 1: $field1$<br/>
      Field 2: $field2$
    </div>
  </html>
  </row>
</dashboard>

Can you use a token from one dashbaord in another dashboard that's linked to it?

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases