topic How to pass a multiselect input from one dashboard via drilldown to another? in Dashboards & Visualizations

How to pass a multiselect input from one dashboard via drilldown to another?

aahiri — Fri, 24 Jan 2020 10:27:23 GMT

Hello,

I have two dashboards, both with some input fields, with one of them being common between both; a multiselect input field.

This multiselect input field has a token prefix and a suffix with the delimiter OR.

  <label>Application</label>
  <choice value="app1">A</choice>
  <choice value="app2">B</choice>
  <valuePrefix>index=phase-</valuePrefix>
  <valueSuffix>-app</valueSuffix>
  <delimiter> OR </delimiter>
</input>

and in the search query, I have

| tstats count as Total WHERE ($app$)

So in the original dashboard, the search is fine.
However, in drilldown, I have Link to another dashboard
form.app=$app$
and this causes problems as it passes "index=phase-A-app OR index=phase-B-app" in form.app and in the target dashboard, due to the same token suffix and prefix , the token changes to "index=phase-index=phase-A-app OR index=phase-B-app-app" which is wrong.

So, my question is, how do I deal with this to be able to send form.app=A form.app=B to the destination dashboard?

Thanks in advance,
Regards,
aahiri

Re: How to pass a multiselect input from one dashboard via drilldown to another?

maciep — Sat, 25 Jan 2020 14:18:58 GMT

what if you pass the form token instead?

form.app=$form.app$

Re: How to pass a multiselect input from one dashboard via drilldown to another?

aahiri — Tue, 28 Jan 2020 13:00:25 GMT

thank you! I tried this, and now I have
form.app=A,B

is there a way to manipulate this on the destination dashboard to make it two distinct values?

Re: How to pass a multiselect input from one dashboard via drilldown to another?

cpsplunkappsupp — Tue, 28 Jan 2020 13:44:03 GMT

hi @aahiri
Did you find any solution for this? I have the same issue..

Re: How to pass a multiselect input from one dashboard via drilldown to another?

maciep — Tue, 28 Jan 2020 13:47:07 GMT

is it set up as an input on the destination too? If so, just give that input the same processing rules (prefix, suffix, delim, whatever) as in the source dashboard?

Re: How to pass a multiselect input from one dashboard via drilldown to another?

cpsplunkappsupp — Tue, 28 Jan 2020 14:03:59 GMT

It has the same values.
The issue is that when drilling down, the URL contains "form.indices=(history%2Csummary)" instead of "form.indices=history&form.indices=summary"

Re: How to pass a multiselect input from one dashboard via drilldown to another?

maciep — Tue, 28 Jan 2020 14:08:40 GMT

hmm...ok. i'm at work currently but can maybe try to work on an example later tonight, if i can get it working

Re: How to pass a multiselect input from one dashboard via drilldown to another?

maciep — Wed, 29 Jan 2020 13:07:05 GMT

Here's a sample dashboard....the change on the input formats the token the way you need it...then you use it in the drilldown. In this case, the token on the destination dashboards is "t_comp".

Let me know if something like this works for you.

<form>
  <label>Eric_Test_10</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="t_component">
      <label>choose components</label>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>index=_internal sourcetype=splunkd | stats count by component</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>component="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <change>
         <eval token="t_drilldown_tokens">"form.t_comp=" . replace(mvjoin($form.t_component$,","),",","&amp;form.t_comp=")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$t_drilldown_tokens$</title>
      <table>
        <title>$form.t_component$</title>
        <search>
          <query>index=_internal $t_component$
| stats count by component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">eric_test_20?$t_drilldown_tokens|n$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Re: How to pass a multiselect input from one dashboard via drilldown to another?

aahiri — Wed, 30 Sep 2020 03:57:15 GMT

Thanks for this! For sure it's a step in the right direction.
However, for some reason it doesn't seem to work all the time.
Sometimes even when both options are selected, only one of the options (random option) is passed in the $t_drilldown_tokens|n$

edit: i figured out why. it's because I have a submit button 😐