Dashboards & Visualizations

How do I pass the current form values to a drilldown link

chapa
Explorer

I have a dataset that has multiple attributes:
accountNumber, deviceNumber, eventName, status

I built a dashboard with 4 panels each showing "chart count by x" for each of the 4 attributes.

I want to allow to user to click on a value in the panel to filter the dashboard on that value, but I also want them to compound. So in order to do so, I have to pass, not only the click.value, but also each of the form's current values like this:

<drilldown>
  <link>
    <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$form.deviceNumber$&form.eventName=$form.eventName$&form.status=$form.status$&form.timePicker.earliest=$form.timePicker.earliest$&form.timePicker.latest=$form.timePicker.latest$&earliest=0&latest=]]>
  </link>
</drilldown>

which is kind of a pain.

Is there a way to send a single form.values or token that would pass all the form's current values so I can shorten the link to this:

 <drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.allValues=$form.allValues$]]>
   </link>
 </drilldown>
0 Karma

jkat54
SplunkTrust
SplunkTrust

There is a way but it's not pretty.

You could eval mvzip them all together in search strings or otherwise create a multi value field with all the drop down values. Then put that field in a table for the user to click. Then when they clicked, the multi valued token would go through the drill down and you could use eval mvindex to extract the individual tokens back out.

You might also be interested in this:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

There's a subsection on using mv fields in drill downs.

0 Karma

somesoni2
Revered Legend

AFAIK, there is no such option in simple xml. Although, you can remove some $form. prefix for local tokens, making little better

<drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$deviceNumber$&form.eventName=$eventName$&form.status=$status$&form.timePicker.earliest=$timePicker.earliest$&form.timePicker.latest=$timePicker.latest$]]>
   </link>
 </drilldown>
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...