<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Drilldown using two different token values obtained from two inputs in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701797#M57554</link>
    <description>&lt;P&gt;I have a table which is getting data from one of our indexes, somewhat like below:&lt;/P&gt;&lt;P&gt;&amp;lt;table&amp;gt;&lt;BR /&gt;&amp;lt;title&amp;gt;Tech Spec Values for Selected Node:&amp;lt;/title&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;index=test_index_prod sourcetype="SPEC"&lt;BR /&gt;| eventstats max(rundate) as maxDate, max(runtime) as maxTime, count as fno&lt;BR /&gt;| where rundate=maxDate AND runtime=maxTime&lt;BR /&gt;| search node="$form.tokenNode$" outcome="$form.tokenSwitch"&lt;BR /&gt;| table node, outcome, name, class, resource&lt;BR /&gt;| sort node, name&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;drilldown&amp;gt;&lt;BR /&gt;&amp;lt;set token="tokenNode"&amp;gt;$click.value$&amp;lt;/set&amp;gt;&lt;BR /&gt;&amp;lt;set token="tokenSwitch"&amp;gt;$click.value$&amp;lt;/set&amp;gt;&lt;BR /&gt;&amp;lt;/drilldown&amp;gt;&lt;BR /&gt;&amp;lt;/table&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;And then I have two radio button fields with token names as tokenNode &amp;amp; tokenSwitch with both having different values. I want the drilldown to happen when any of the radio button value is selected by user from the two radio button input fields.&lt;/P&gt;</description>
    <pubDate>Mon, 14 Oct 2024 10:53:41 GMT</pubDate>
    <dc:creator>newsplunker2024</dc:creator>
    <dc:date>2024-10-14T10:53:41Z</dc:date>
    <item>
      <title>Drilldown using two different token values obtained from two inputs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701751#M57543</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;I'm trying to drilldown on a table using two different input values (from two radio button inputs). When I have input from one radio button, it works all fine.&lt;/P&gt;&lt;P&gt;For eg, if I have this statement in drilldown tag of table it works perfectly:&lt;/P&gt;&lt;P&gt;&amp;lt;set token="tokenNode"&amp;gt;$click.value$&amp;lt;/set&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;However, when I place second set token statements It just says No Results Found:&lt;/P&gt;&lt;P&gt;I tried both click.value &amp;amp; click.value2&lt;/P&gt;&lt;P&gt;Option 1:&lt;/P&gt;&lt;P&gt;&amp;lt;set token="tokenNode"&amp;gt;$click.value$&amp;lt;/set&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;lt;set token="tokenSwitch"&amp;gt;$click.value$&amp;lt;/set&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Option 2:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;lt;set token="tokenNode"&amp;gt;$click.value$&amp;lt;/set&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;lt;set token="tokenSwitch"&amp;gt;$click.value2$&amp;lt;/set&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 14 Oct 2024 05:37:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701751#M57543</guid>
      <dc:creator>newsplunker2024</dc:creator>
      <dc:date>2024-10-14T05:37:37Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown using two different token values obtained from two inputs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701778#M57549</link>
      <description>&lt;P&gt;Please provide more detail - what is the source of your dashboard? how are you using the tokens? if the tokens both have the same value, can you not just use one token?&lt;/P&gt;</description>
      <pubDate>Mon, 14 Oct 2024 08:44:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701778#M57549</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-10-14T08:44:17Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown using two different token values obtained from two inputs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701797#M57554</link>
      <description>&lt;P&gt;I have a table which is getting data from one of our indexes, somewhat like below:&lt;/P&gt;&lt;P&gt;&amp;lt;table&amp;gt;&lt;BR /&gt;&amp;lt;title&amp;gt;Tech Spec Values for Selected Node:&amp;lt;/title&amp;gt;&lt;BR /&gt;&amp;lt;search&amp;gt;&lt;BR /&gt;&amp;lt;query&amp;gt;index=test_index_prod sourcetype="SPEC"&lt;BR /&gt;| eventstats max(rundate) as maxDate, max(runtime) as maxTime, count as fno&lt;BR /&gt;| where rundate=maxDate AND runtime=maxTime&lt;BR /&gt;| search node="$form.tokenNode$" outcome="$form.tokenSwitch"&lt;BR /&gt;| table node, outcome, name, class, resource&lt;BR /&gt;| sort node, name&amp;lt;/query&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;/search&amp;gt;&lt;BR /&gt;&amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;&lt;BR /&gt;&amp;lt;drilldown&amp;gt;&lt;BR /&gt;&amp;lt;set token="tokenNode"&amp;gt;$click.value$&amp;lt;/set&amp;gt;&lt;BR /&gt;&amp;lt;set token="tokenSwitch"&amp;gt;$click.value$&amp;lt;/set&amp;gt;&lt;BR /&gt;&amp;lt;/drilldown&amp;gt;&lt;BR /&gt;&amp;lt;/table&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;And then I have two radio button fields with token names as tokenNode &amp;amp; tokenSwitch with both having different values. I want the drilldown to happen when any of the radio button value is selected by user from the two radio button input fields.&lt;/P&gt;</description>
      <pubDate>Mon, 14 Oct 2024 10:53:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701797#M57554</guid>
      <dc:creator>newsplunker2024</dc:creator>
      <dc:date>2024-10-14T10:53:41Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown using two different token values obtained from two inputs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701803#M57555</link>
      <description>&lt;P&gt;This seems a bit confused - drilldown happens when the user clicks on a cell in the table. In your instance, this appears to set two tokens to the same value (based on where the user clicked). Your search also includes using the value of two input tokens. When either of these inputs is changed, the search will run again, using the new values of the tokens. This isn't drilldown. This is just how inputs and tokens work.&lt;/P&gt;&lt;P&gt;Please can you try to give more concrete examples of what your events look like, what the rest of your dashboard looks like, what you would like to happen when the user interacts with your dashboard, etc.?&lt;/P&gt;</description>
      <pubDate>Mon, 14 Oct 2024 11:42:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701803#M57555</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-10-14T11:42:14Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown using two different token values obtained from two inputs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701807#M57556</link>
      <description>&lt;P&gt;I'm sorry if I'm causing confusion. And not sure if you would call this drilldown.&lt;/P&gt;
&lt;P&gt;My requirement:&lt;/P&gt;
&lt;P&gt;I have two input fields(type - radio buttons). And depending on what value the user selects I want the filters to apply on two of the fields in the table namely node &amp;amp; outcome. For which I've written these statements in the table query:&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;| search node="$form.tokenNode$" outcome="$form.tokenSwitch$"&lt;/LI-CODE&gt;
&lt;P&gt;Node(radio button has below options):&lt;/P&gt;
&lt;P&gt;ABC&lt;/P&gt;
&lt;P&gt;DEF&lt;/P&gt;
&lt;P&gt;XYZ&lt;/P&gt;
&lt;P&gt;Outcome(radio button has below options):&lt;/P&gt;
&lt;P&gt;True&lt;/P&gt;
&lt;P&gt;False&lt;/P&gt;
&lt;P&gt;Both&lt;/P&gt;
&lt;P&gt;If I use one radio button(lets say just node) field it works, however when I add the second one it doesn't work. Means when im selecting node values from the radio button, the table is reloading &amp;amp; filtering the data based on the node value selected. I want the same to work for the second radio button as well.&lt;/P&gt;
&lt;P&gt;here is how these input (radio buttons look like):&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;&amp;lt;input type="radio" token="tokenNode" searchWhenChanged="true"&amp;gt;
&amp;lt;label&amp;gt;Node&amp;lt;/label&amp;gt;
&amp;lt;choice value="ABC"&amp;gt;ABC&amp;lt;/choice&amp;gt;
&amp;lt;choice value="DEF"&amp;gt;DEF&amp;lt;/choice&amp;gt;
&amp;lt;choice value="XYZ"&amp;gt;XYZ&amp;lt;/choice&amp;gt;
&amp;lt;default&amp;gt;ABC&amp;lt;/default&amp;gt;
&amp;lt;initialValue&amp;gt;ABC&amp;lt;/initialValue&amp;gt;
&amp;lt;/input&amp;gt;
&amp;lt;input type="radio" token="tokenSwitch" searchWhenChanged="true"&amp;gt;
&amp;lt;label&amp;gt;Outcome&amp;lt;/label&amp;gt;
&amp;lt;choice value="True"&amp;gt;True&amp;lt;/choice&amp;gt;
&amp;lt;choice value="False"&amp;gt;False&amp;lt;/choice&amp;gt;

&amp;lt;choice value="Both"&amp;gt;Both&amp;lt;/choice&amp;gt;
&amp;lt;default&amp;gt;True&amp;lt;/default&amp;gt;
&amp;lt;initialValue&amp;gt;True&amp;lt;/initialValue&amp;gt;
&amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;
&lt;P&gt;Hope I'm able to explain it.&lt;/P&gt;</description>
      <pubDate>Mon, 14 Oct 2024 14:07:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701807#M57556</guid>
      <dc:creator>newsplunker2024</dc:creator>
      <dc:date>2024-10-14T14:07:13Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown using two different token values obtained from two inputs</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701810#M57557</link>
      <description>&lt;P&gt;It sounds like it is working, just not with the results you expect? Search has an implied AND so perhaps you need an explicit OR?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| search node="$form.tokenNode$" OR outcome="$form.tokenSwitch$"&lt;/LI-CODE&gt;</description>
      <pubDate>Mon, 14 Oct 2024 12:50:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-using-two-different-token-values-obtained-from-two/m-p/701810#M57557</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2024-10-14T12:50:47Z</dc:date>
    </item>
  </channel>
</rss>

