Dashboards & Visualizations

How to pass static text or value to a drilldown?

ahogbin
Communicator

Hello,

I am trying to pass a static value to another form but not having much luck

<drilldown target="My New Window">
          <link>
            <![CDATA[quotes_by_broker?form.token_range=$totalQuotes>=1 AND totalQuotes<=20$&earliest=$earliest$&latest=$latest$
       ]]>
          </link>
        </drilldown>

The drilldown is called when a user clicks on a value and should load a form (which it does) and populate the token_range field which in turn is then used in a search. The reason I am trying to pass a static value is that source dashboard displays results as a single value and I would like to then display the breakdown to the user in the linked dashboard.

The problem I have is that the new dashboard / form loads but the value populated into the token_range field is $totalQuotes> and nothing else.

I have tried adding $$ to the value but no joy.

Open to suggestions and any help is greatly appreciated.

Cheers,

Alastair

0 Karma
1 Solution

lguinn2
Legend

I don't think you can have spaces in a link. Plus, I don't know why you put all of the $ in there...
I would try

<![CDATA[quotes_by_broker?form.token_range="totalQuotes>=1 AND totalQuotes<=20"&earliest=$earliest$&latest=$latest$
        ]]>

But you may have to actually encode it by replacing spaces with %20.

View solution in original post

0 Karma

lguinn2
Legend

I don't think you can have spaces in a link. Plus, I don't know why you put all of the $ in there...
I would try

<![CDATA[quotes_by_broker?form.token_range="totalQuotes>=1 AND totalQuotes<=20"&earliest=$earliest$&latest=$latest$
        ]]>

But you may have to actually encode it by replacing spaces with %20.

0 Karma

ahogbin
Communicator

Hello,

Thanks for the above but I have narrowed to the issue down to the '=' sign. For some reason this is getting stripped when the text is being passed across. If I remove the '=' sign then all works but the search returns the incorrect results.

Is there a way of stopping the sign from being removed ?

Cheers.

0 Karma

ahogbin
Communicator

Found it .... adding %3D fixes the issue.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...