topic Re: Cannot send drilldown multiple tokens to other form input in Splunk Enterprise

Cannot send drilldown multiple tokens to other form input

altink — Tue, 29 Sep 2020 14:59:11 GMT

Hello

I am trying to drilldown a table dashboard to another form's several inputs, but I get the variable names instead of their values.

The main form - scan_data_02 - has (between others) a statistical table dashboard, whose records are present.

I have another form - scan_item_details_02 which has three simple text inputs and a table dashboard, which is bound in search to the three inputs. The search in this form works correctly by itself, the three inputs have default values, the table has data and it responds to every change in the three inputs.

scan_item_details_02:

<form>
  <label>Scan Item Details 02</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="text" token="field_scan_id">
      <label>Scan Id</label>
      <default>20170709_125008_Ora_DB_LV</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="text" token="field_vln_id">
      <label>Vln Id</label>
      <default>201</default>
    </input>
    <input type="text" token="field_db_name">
      <label>Database</label>
      <default>Oracle Live DB</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=omega_ds_idx_01 
DB_NAME=$field_db_name$ SCAN_ID=$field_scan_id$ VLN_ID=$field_vln_id$
| table  DB_NAME  SCAN_ID VLN_ID VLN_NAME .........</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="count">3</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

The URL of the correct standalone working of the detail form is:

http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_02?form.field_scan_id=20170709_125008_Ora_DB_LV&form.field_db_name=Oracle%20Live%20DB&form.field_vln_id=201

The problem starts when I drill-down from the main form "scan_data_02".

The dashboard and drill-down code is:

<panel>
      <table>
        <title>DRILL</title>
        <search>
          <query>index=........ 
| table  DB_NAME  SCAN_ID VLN_ID VLN_NAME .......</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="count">4</option>
        <drilldown target="blank">
          <link>scan_item_details_02?form.field_scan_id=$row.SCAN_ID&amp;form.field_vln_id=$row.VLN_ID&amp;form.field_db_name=$row.DB_NAME</link>
        </drilldown>
      </table>
    </panel>

Instead of having the three inputs completed with the three field values - I get $row.field_name on them - $row.SCAN_ID instead of the scan name. so for two others - by respective field

The error URL is:

http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_02?form.field_scan_id=%24row.SCAN_ID&form.field_vln_id=%24row.VLN_ID&form.field_db_name=%24row.DB_NAME

Please advise on the right command for drill-down

thank you very much,

best regards
Altin

Re: Cannot send drilldown multiple tokens to other form input

altink — Tue, 29 Sep 2020 14:59:17 GMT

Fixed:
scan_item_details_02?form.field_scan_id=$row.SCAN_ID$&form.field_vln_id=$row.VLN_ID$&form.field_db_name=$row.DB_NAME$

forgot the $ at the end of field_name

Re: Cannot send drilldown multiple tokens to other form input

niketn — Thu, 20 Jul 2017 16:20:03 GMT

@altink, please convert your comment to answer and accept the same to mark this question as answered.

Re: Cannot send drilldown multiple tokens to other form input

altink — Tue, 29 Sep 2020 15:01:50 GMT

Fixed:
scan_item_details_02?form.field_scan_id=$row.SCAN_ID$&form.field_vln_id=$row.VLN_ID$&form.field_db_name=$row.DB_NAME$

forgot the $ at the end of field_name

Re: Cannot send drilldown multiple tokens to other form input

altink — Thu, 20 Jul 2017 20:01:06 GMT

The same does not work when the token input elements are removed and remaining only in the search of the target form.
no results are found - while there should be - as in the previous try with input elements involved.

Details for code is:

<form>
  <label>Scan Item Details 03</label>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>field1</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=omega_ds_idx_01 
DB_NAME=$form.field_db_name$ SCAN_ID=$form.field_scan_id$ VLN_ID=$form.field_vln_id$
| table DB_NAME SCAN_ID VLN_ID VLN_NAME CTRL_SUMMARY CTRL_OUTPUT</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="count">3</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

the input text field1 has been inserted just to have the tag of the form added

Problem:
The dashboard returns no rows: "No results found. "

The URL is:

http://192.168.1.71:8000/en-US/app/Omega_DS_App_02/scan_item_details_03?form.field_scan_id=20170714_210278_Ora_DB_T01&form.field_vln_id=204&form.field_db_name=Ora%20DB%20Test%2001

The search should return data:

SCAN_ID=20170714_210278_Ora_DB_T01
VLN_ID=204
DB_NAME="Ora DB Test01"

index=omega_ds_idx_01 SCAN_ID=20170714_210278_Ora_DB_T01
VLN_ID=204 
DB_NAME="Ora DB Test 01"

does return

from the following Ticket:

https://answers.splunk.com/answers/219807/how-to-hide-a-dashboard-panel-containing-inputs-th.html

do I have to read that the drill-down at target form (dashboard) - is not supported without visual Input elements in the middle?
if not - please advise on how to do without input elements

best regards
Altin