topic Re: Help to use token drilldown with an html link in Splunk Enterprise

Help to use token drilldown with an html link

jip31 — Tue, 13 Sep 2022 13:40:31 GMT

hello

In a first dashboard, i use 2 dropdown list

the first dropdown list concerns a relative time choice and the second dropdown list concern a site choice

I need to retrieve in a second dashboard (there is also the same dropdown list in this dash) the choice done from these 2 dropdown list by executing html link

<form> <label>TEST</label> <fieldset submitButton="false"> <input type="dropdown" token="period"> <label>Période</label> <choice value="1654466400.0">Lundi 6 Juin 2022</choice> <choice value="1655071200.0">Lundi 13 Juin 2022</choice> <choice value="1655676000.0">Lundi 20 Juin 2022</choice> <choice value="1656280800.0">Lundi 27 Juin 2022</choice> <change> <eval token="debut">period</eval> <eval token="fin">debut+432000</eval> <eval token="debut_4w">relative_time(debut,"-4w")</eval> <eval token="fin_4w">relative_time(debut,"-0w")</eval> </change> <default>1655071200.0</default> <initialValue>1655071200.0</initialValue> </input> <input type="dropdown" token="site" searchWhenChanged="true"> <label>Espace </label> <fieldForLabel>site</fieldForLabel> <fieldForValue>site</fieldForValue> <search> <query>`index_mes` | dedup site | table site | sort + site</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <choice value="*">*</choice> <default>*</default> <initialValue>*</initialValue> </input> </fieldset> <row> <panel> <html> <a href="/app/spl_pub/bpe?form.site=$form.site|u$&form.period.earliest=$form.period$&form.period.latest=$form.period$" target="_blank">Cliquez ici</a> </html> </panel> </row>

it works for the site by adding | search site="$form.site$" in the second dashboard for every search but it doesnt works for the time

so what is wrong in the html link and how to take into account the time choice done in the first dashboard in the second dashboard?

thanks

Re: Help to use token drilldown with an html link

scelikok — Sun, 18 Sep 2022 09:26:19 GMT

Hi @jip31,

Since your period input is not time, you cannot use the earliest and latest. You should pass this token same as site token.

Please test below;

<form> <label>TEST</label> <fieldset submitButton="false"> <input type="dropdown" token="period"> <label>Période</label> <choice value="1654466400.0">Lundi 6 Juin 2022</choice> <choice value="1655071200.0">Lundi 13 Juin 2022</choice> <choice value="1655676000.0">Lundi 20 Juin 2022</choice> <choice value="1656280800.0">Lundi 27 Juin 2022</choice> <change> <eval token="debut">period</eval> <eval token="fin">debut+432000</eval> <eval token="debut_4w">relative_time(debut,"-4w")</eval> <eval token="fin_4w">relative_time(debut,"-0w")</eval> </change> <default>1655071200.0</default> <initialValue>1655071200.0</initialValue> </input> <input type="dropdown" token="site" searchWhenChanged="true"> <label>Espace </label> <fieldForLabel>site</fieldForLabel> <fieldForValue>site</fieldForValue> <search> <query>`index_mes` | dedup site | table site | sort + site</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <choice value="*">*</choice> <default>*</default> <initialValue>*</initialValue> </input> </fieldset> <row> <panel> <html> <a href="/app/spl_pub/bpe?form.site=$form.site|u$&form.period=$form.period$" target="_blank">Cliquez ici</a> </html> </panel> </row> </form>

Re: Help to use token drilldown with an html link

bowesmana — Sun, 18 Sep 2022 22:39:16 GMT

2 issues:

1. Does your second dashboard have inputs? The point of using "form".XXX in the URL is that a token prefixed with FORM is an input element in the target dashboard. If you just are looking to pass a token to the other dashboard which can be used in the dashboard and there are no inputs, then simply pass the token like this

<a href="/app/spl_pub/bpe?site=$form.site$ earliest=$form.debut_4w$ latest=$form.fin_4w$...

Then in your second dashboard, you can include this in the search

your_search earliest=$earliest$ latest=$latest$

2. If you DO have inputs in the second dashboard, then if you have one with token period AND it is a time picker input, then the syntax you have appears correct, but if it is NOT a time picker in the second dashboard, then form.period.earliest/latest syntax does not apply.

Also, I am wondering if you mean to be passing the debut/fin tokens rather than period as period only has a single value passed to the second dashboard - is that what you intended?

Re: Help to use token drilldown with an html link

jip31 — Mon, 19 Sep 2022 05:51:27 GMT

Hi Scellilok

I ave already done this but it doesnt works....

Here is what I have in the URL

form.period=1655676000.0&form.date.earliest=1654466400&form.date.latest=1654898400

Re: Help to use token drilldown with an html link

jip31 — Mon, 19 Sep 2022 07:19:55 GMT

Not sure to understand everyting but

1 - The second dashboard is a detailed view of the first dasboard but it doesnt means that the panel in the second dashboard has the same role that the panel in the first dashboard

In other words, I just want to retrieve in the second dashboard the choice done in the first dashboard from the 2 dropdown list

So when I choose a site and a period in the first dashboard, I need to retrieve the same choice in the second dashboard

It works for the site but not for the period

In order to test, I have added the same period dropdown list in the second dashboard as in the first dashboard

And the only way to retrieve the same period is to use this HTML link in te first dashboard

<a href="/app/spl_pub/bp?form.site=$form.site|u$&form.period=$form.period$"

So the solution will be to link the period dropdown list of the second dashboard with each panel of the dashboard but i dont succeed...

I tried with

| search site="$form.site$" AND period=$period$

in the search

and

2 - I just want to retieve in the second dashboard the period choice done in the first dashboard for these 4 tokens

<eval token="debut">period</eval> <eval token="fin">debut+432000</eval> <eval token="debut_4w">relative_time(debut,"-4w")</eval> <eval token="fin_4w">relative_time(debut,"-0w")</eval>

Re: Help to use token drilldown with an html link

bowesmana — Mon, 19 Sep 2022 23:16:07 GMT

If a dashboard has an input, then in the URL for that dashboard, you will see URL parameters, such as

form.XXX

where XXX is the token defined in the input. However, in your searches you ONLY use the token name XXX, not $form.XXX$.

So, when you are passing tokens between dashboards, you only need to name them "form.XXX" if the receiving dashboard has inputs, which is why you use "form." in the token name.

If your receiving dashboard does not have inputs, then you only need to pass the token itself (no "form.") in the URL, i.e. debut=$debut$

Regardless of whether you have an input in the second dashboard, you only use the token name in searches.

So to pass the 4 tokens in your URL you would need to set

<a href="/app/spl_pub/bp?site=$form.site|u$&debut=$debut$&fin=$fin$&debut_4w=$debut_4w$&fin_4w=$fin_4w$"

and your searches will be

| search site="$site$" AND period>$debut$ AND period<$fin$

or something like that depending on what your "period" represents. However, as your periods are date related, I suspect you might even want your search time range to be set in the XML as

<earliest>$debut_4w$</earliest> <latest>$fin_4w$</latest>

Re: Help to use token drilldown with an html link

jip31 — Tue, 20 Sep 2022 07:12:33 GMT

not sure to understand everything but i think the solution is not too far

I summarize :

when I use this link in the first dash

<a href="/app/spl_pub_dashboard/bpe2?form.site=$form.site|u$&form.period=$form.period$"

I can retrieve the period choice in the second dropdown list of the second dash

I have also added this in every search of the second dashboard (like i said i never use earliest=$debut_4w$ latest=$fin_4w$ in the second dashboard)

earliest=$debut$ latest=$fin$

when I run a search in the second dashboard, I can see that the period correspond well to the period selected in the first dashboard (it's not the case if I use what you propose

debut=$debut$&amp;fin=$fin$&amp;debut_4w=$debut_4w$&amp;fin_4w=$fin_4w$"

Now, the last problem i have in the second dashboard is that all the searches tell me "waiting for input"

I have to select a new period time in the dropdown list of the second dashboard in order to run all the searches...

so how to do for that the period selected in the first dashboard apply to all searches of the second dashboard?

Re: Help to use token drilldown with an html link

scelikok — Tue, 20 Sep 2022 08:19:08 GMT

Hi @jip31,

Please try below syntax on destination dashboard. Since secondary tokens are not triggered on change, you should use set instead of eval and also $value$ token to get the period contents after change.

<change> <set token="debut">$value$</set> <eval token="fin">debut+432000</eval> <eval token="debut_4w">relative_time(debut,"-4w")</eval> <eval token="fin_4w">relative_time(debut,"-0w")</eval> </change>

Re: Help to use token drilldown with an html link

bowesmana — Tue, 20 Sep 2022 22:40:26 GMT

Please post here the complete details of the form inputs in both dashboard and the searches you are trying to use, i.e. all the <fieldset> elements of the inputs from dashboard 1 and 2 and the <query> section of the search you are using in the second dashboard.

Please post it using the </> code button, rather than posting images.

Re: Help to use token drilldown with an html link

jip31 — Wed, 21 Sep 2022 04:51:26 GMT

Hi!

Thanks not it works fine!