topic Re: How to create a drilldown selection to update form tokens on a dashboard? in Dashboards & Visualizations

How to create a drilldown selection to update form tokens on a dashboard?

phoenixdigital — Thu, 12 Nov 2015 00:32:49 GMT

So this example dashboard will work on any Splunk instance.

Myself and our other engineers can't seem to get the input at the top of the form to update?

The only solutions we can think of would be either custom javascript or have the page submit to itself with the fields passed in the URL.

Test dashboard below.

<form>
  <label>Drilldown Example Table Complex</label>
  <fieldset submitButton="false">
    <input type="text" token="component">
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd| stats count(eval(log_level="INFO")) as INFO  count(eval(log_level="ERROR")) as ERROR by component</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
        <drilldown>
          <condition field="component">
              <set token="component">$click.value$</set>
              <set token="log_level">*</set>
          </condition>
          <condition field="INFO">
              <set token="log_level">$click.name2$</set>
              <set token="component">$click.value$</set>
          </condition>
          <condition field="ERROR">
              <set token="log_level">$click.name2$</set>
              <set token="component">$click.value$</set>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Search = index=_internal component="$component$" log_level="$log_level$"</title>
        <search>
          <query>index=_internal component="$component$" log_level="$log_level$"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

Re: How to create a drilldown selection to update form tokens on a dashboard?

sbrice18 — Fri, 23 Feb 2018 16:20:13 GMT

Drilldown Example Table Complex

<input type="text" token="component" searchWhenChanged="true">
  <label>component</label>
  <default>*</default>
</input>
<input type="text" token="log_level" searchWhenChanged="false">
  <label>log_level</label>
  <default>*</default>
</input>
<input type="time" token="field1">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <table>
    <search>
      <query>index=_internal sourcetype=splunkd| stats count(eval(log_level="INFO")) as INFO  count(eval(log_level="ERROR")) as ERROR by component</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="rowNumbers">false</option>
    <option name="wrap">true</option>
    <drilldown>
      <condition field="component">
        <set token="component">$click.value$</set>
        <set token="log_level">*</set>
      </condition>
      <condition field="INFO">
        <set token="log_level">$click.name2$</set>
        <set token="component">$click.value$</set>
      </condition>
      <condition field="ERROR">
        <set token="log_level">$click.name2$</set>
        <set token="component">$click.value$</set>
      </condition>
    </drilldown>
  </table>
</panel>


<panel>
  <event>
    <title>$component$  $log_level$</title>
    <search>
      <query>index="_internal" sourcetype=splunkd component="$component$" log_level="$log_level$"</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <option name="list.drilldown">none</option>
    <option name="raw.drilldown">none</option>
    <option name="table.drilldown">none</option>
    <option name="type">list</option>
  </event>
</panel>

Re: How to create a drilldown selection to update form tokens on a dashboard?

michaeltokar — Fri, 20 Apr 2018 03:40:16 GMT

How does this address the problem, which is that the input field on the dashboard form does not update with the selected drill down value?

Re: How to create a drilldown selection to update form tokens on a dashboard?

phoenixdigital — Fri, 20 Apr 2018 03:57:22 GMT

It doesn't address it . This was still part of the original question just showing a more complex form.

I'm still waiting on a response 2.5 years on 🙂

Re: How to create a drilldown selection to update form tokens on a dashboard?

michaeltokar — Fri, 20 Apr 2018 05:07:39 GMT

I was having the same issue - the documentation did not make it clear how to do this for drill down's that altered the same dashboard as opposed to loading a new one in a new tab. There is a clue, however, in how it recommends to set form inputs on new dashboards:

<drilldown>
   <link>/app/foursquare_vegas/vegas_badge_1?form.badge=$click.value2$</link>
</drilldown>

Assuming that badge was the token name here, the recommendation is to use the URL parameter form.badge. If we do the same with our <drilldown> element, it will have the effect of updating the input at the top of the dashboard.

<drilldown>
 <condition field="component">
     <set token="component">$click.value$</set>
     <set token="form.component">$click.value$</set>
     <set token="log_level">*</set>
 </condition>
 <condition field="INFO">
     <set token="log_level">$click.name2$</set>
     <set token="component">$click.value$</set>
     <set token="form.component">$click.value$</set>
 </condition>
 <condition field="ERROR">
     <set token="log_level">$click.name2$</set>
     <set token="component">$click.value$</set>
     <set token="form.component">$click.value$</set>
 </condition>
</drilldown>

Re: How to create a drilldown selection to update form tokens on a dashboard?

niketn — Fri, 20 Apr 2018 08:10:31 GMT

@phoenixdigital, set the default value of Text input to $component$ i.e. <default>$component$</default> and in the <init> section set component token to asterisk ( * ). Please try out and confirm.

PS: <init> section is available in version 6.5 and above. You would need a dummy search to set component to asterisk using search event handler in case you are on Splunk version 6.4 or previous.

<form>
  <label>Drilldown Example Table Complex</label>
  <init>
    <set token="component">*</set>
  </init>
  <fieldset submitButton="false">
    <input type="text" token="component">
      <default>$component$</default>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd| stats count(eval(log_level="INFO")) as INFO  count(eval(log_level="ERROR")) as ERROR by component</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="component">
            <set token="component">$click.value$</set>
            <set token="log_level">*</set>
          </condition>
          <condition field="INFO">
            <set token="log_level">$click.name2$</set>
            <set token="component">$click.value$</set>
          </condition>
          <condition field="ERROR">
            <set token="log_level">$click.name2$</set>
            <set token="component">$click.value$</set>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Search = index=_internal component="$component$" log_level="$log_level$"</title>
        <search>
          <query>index=_internal component="$component$" log_level="$log_level$"</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>