topic Re: Classic Dashboard Drilldown Click on a Value and Set Token in Dashboards & Visualizations

Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Tue, 13 May 2025 18:03:06 GMT

Hello! I have a Classic Dashboard in Splunk and I am currently working with an Events pane. I am trying to set a token via drilldown. Here is my code:

<event> <search> <query>$case_token$ $host_token$ $level_token$ $rule_token$</query> </search> <fields>Timestamp, host, Computer, Level, Channel, RecordID, EventID, RuleTitle, Details, _time</fields> <option name="count">50</option> <option name="list.drilldown">none</option> <option name="list.wrap">1</option> <option name="raw.drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="table.drilldown">all</option> <option name="table.sortDirect">asc</option> <option name="table.wrap">1</option> <option name="type">table</option> <drilldown> <condition field="Channel"> <set token="channel_token">$click.value$</set> </condition> </drilldown> </event>

There's two problems:

1. The token is not being set when I click on the table.

2. The condition to only select from the Channel fields is not working.

Thank you in advance!

Re: Classic Dashboard Drilldown Click on a Value and Set Token

isoutamo — Tue, 13 May 2025 18:08:48 GMT

You can start with this app https://classic.splunkbase.splunk.com/app/1603/

WIth it you can see some examples how you should play with tokens and then try those with your own dashboard.

Here is one UG presentation how to use tokens etc. https://data-findings.com/wp-content/uploads/2024/09/HSUG-20240903-Tiia-Ojares.pdf

Re: Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Tue, 13 May 2025 18:29:07 GMT

Hi! Thank you for the resources! I have been reviewing them, as well as doing other search. I still am unsure, so any specific help you can offer is appreciated.

Re: Classic Dashboard Drilldown Click on a Value and Set Token

isoutamo — Tue, 13 May 2025 18:56:15 GMT

Can you post these tokens?
$case_token$ $host_token$ $level_token$ $rule_token$

Re: Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Tue, 13 May 2025 19:17:19 GMT

Yes! The token are made like this. Here are some examples. These tokens are working correctly.

<input type="dropdown" token="case_token" searchWhenChanged="true"> <label>Case Selector</label> <fieldForLabel>case</fieldForLabel> <fieldForValue>case</fieldForValue> <search> <query>| tstats count where index=string* by index | table index </query> </search> </input> <input type="multiselect" token="host_token" searchWhenChanged="true"> <label>Host</label> <fieldForLabel>Host</fieldForLabel> <fieldForValue>host</fieldForValue> <search> <query>| tstats count where $case_token$ by host |table host</query> </search> </input>

What isn't working is the creation of the $channel_token$ made with the drilldown. I think it might be because I'm using an event pane and not a table pane.

Re: Classic Dashboard Drilldown Click on a Value and Set Token

bowesmana — Wed, 14 May 2025 00:08:32 GMT

Can you fully expand an example of the search. I assume Channel a visible field in the event list? Have you explicitly specified Channel as a field in the SPL?

Re: Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Wed, 14 May 2025 12:03:10 GMT

Hi! Yes, here is the complete search:

$case_token$ sourcetype=hayabusa $host_token$ $level_token$ $rule_token$ | table Timestamp, host, Computer, Level, Channel, RecordID, EventID, Ruletitle, Details, *

Channel is added as a field in the table command, as well as specified in the code:

<fields>Timestamp, host, Computer, Level, Channel, RecordID, EventID, RuleTItle, Details</fields>

Re: Classic Dashboard Drilldown Click on a Value and Set Token

bowesmana — Wed, 14 May 2025 22:36:08 GMT

There's something odd in the interaction between the <event> display and the table command and the fields control. I have an example dashboard, which does this search

index=_internal user=* | table _time index sourcetype user * | eval Channel=user

Yet the Channel column is not even shown, even though it is in the <fields> statement.

If I change the table to a fields statement or remove it completely, it works.

Is there any reason you are adding the table command there? It doesn't really serve any purpose, as you are controlling display with the <fields> statement.

Re: Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Thu, 15 May 2025 17:13:47 GMT

Hi! Thank you for your response. When I take out the table command, only the _time, host, Level, and RuleTitle fields show up. The fields I have included in <fields></fields> don't all show up.

Re: Classic Dashboard Drilldown Click on a Value and Set Token

bowesmana — Thu, 15 May 2025 23:20:58 GMT

I believe (although I rarely use the event visualisation) that you must specify a

| fields a b c...

in your SPL to get fields from the event to show up in the event panel as fields. The XML <fields> element is used as a way to limit the display of the available fields from the search, so in order to get those fields there in the first place, you must use the SPL fields command to specify fields you want.

Using the table command is not the right way

Re: Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Fri, 16 May 2025 12:11:36 GMT

Thank you! I changed from the table command to the fields command.

When I tried to use a drilldown again (set host_token = $row.host$), it still didn't work...any ideas?

Re: Classic Dashboard Drilldown Click on a Value and Set Token

yuanliu — Sun, 18 May 2025 14:34:28 GMT

Let me start with the obvious:

Because you are using table in your query, <table /> is the appropriate panel type, not <event/> used in your illustration.
You use drilldown type to be "All", set token to $click.value$ and expect it to take the value of field Channel. That is not how drilldown works. The value should be set to $row.Channel$. (There is another drilldown type "Cell". But if you want to the token to represent Channel, this is inappropriate.)

Here is a complete mock dashboard for you to play with. Wherever you click, the clicked Channel value will be displayed in the panel's title. Play with it and adapt it for your use.

<dashboard version="1.1" theme="light"> <label>Click to set token</label> <description>https://community.splunk.com/t5/Dashboards-Visualizations/Classic-Dashboard-Drilldown-Click-on-a-Value-and-Set-Token/m-p/746080#M58677</description> <row> <panel> <title>Click on any row</title> <table> <title>Channel in that row should be >$channel_token$<</title> <search> <query>index = _internal component=* thread_id=* | rex "^(?<Timestamp>\S+ \S+ \S+)" | rename component as Channel, log_level as Level, event_message as Details, thread_id as RecordID, thread_name as Ruletitle | table Timestamp Level Channel RecordID Ruletitle Details *</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">50</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="channel_token">$row.Channel$</set> </drilldown> </table> </panel> </row> </dashboard>

Re: Classic Dashboard Drilldown Click on a Value and Set Token

bowesmana — Sun, 18 May 2025 23:03:48 GMT

@yuanliu Actually the event display type is perfectly fine if the OP wants it - it has very different behaviour to table - and <event> does support a table mode, but it does appear that conditional specific drilldown does not work as the OP describes - using table and fields command gives different behaviour - I did recreate his behaviour where conditional drilldown does NOT work on the Channel field despite it being visible, but cannot reproduce it.

For example, if using the table command in the SPL, if you create any fields AFTER that statement, those fields do not seem to appear in the event table, whereas if you set them before the table command, it shows that column in the table, whereas using the fields command in SPL it makes no difference.

@lcguilfoil I don't have a specific answer, but if you can click on the magnifying class of the event listing so that it opens up the real search in a new window and post that here, that would be useful - you did not post your entire search - not the one in the XML, but the real search as it runs after all the tokens are set.

Re: Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Mon, 19 May 2025 11:48:30 GMT

Hello, and thank you for your help! Here is my what my dashboard looks like now:

<event> <search> <query>$case_token$ sourcetype=hayabusa $host_token$ $level_token$ $rule_token$ | fields Timestamp, host, Computer, Level, Channel, RecordID, EventID, Ruletitle, Details</query> </search> <fields>Timestamp, host, Computer, Level, Channel, RecordID, EventID, RuleTitle, Details, _time</fields> <option name="count">50</option> <option name="list.drilldown">none</option> <option name="list.wrap">1</option> <option name="raw.drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="table.drilldown">all</option> <option name="table.sortDirect">asc</option> <option name="table.wrap">1</option> <option name="type">table</option> <drilldown> <condition field="Channel"> <set token="channel_token">$click.value$</set> </condition> </drilldown> </event>

Here is what the corresponding search looks like:

index=test-index sourcetype=hayabusa host=* Level=* RuleType=* | fields Timestamp, host, Computer, Level, Channel, RecordID, EventID, Ruletitle, Details

Re: Classic Dashboard Drilldown Click on a Value and Set Token

ITWhisperer — Mon, 19 May 2025 12:42:10 GMT

Has this now been solved (as I can't see anything wrong with what you posted - apart from some obvious harmlessly-redundant options)?

Re: Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Mon, 19 May 2025 12:55:18 GMT

It is not solved, thank you for asking!

1. Can you please alert me to what is harmlessly redundant?

2. The token does not work. I used a drilldown to set Channel to click.value (I also tried to set Channel to row.Channel), but it doesn't work.

Re: Classic Dashboard Drilldown Click on a Value and Set Token

ITWhisperer — Mon, 19 May 2025 13:40:48 GMT

I have a version working with just table.drilldown = all, i.e. list.drilldown and raw.drilldown seem to be redundant. Also, table.drilldown = 1 seems to work.

Which version of Splunk are you using?

Re: Classic Dashboard Drilldown Click on a Value and Set Token

lcguilfoil — Mon, 19 May 2025 13:56:35 GMT

I am using Splunk version 9.4.0.

I got rid of the list and raw drilldown options and made sure only table.drilldown was present and set to all. It's still not working.

Re: Classic Dashboard Drilldown Click on a Value and Set Token

ITWhisperer — Mon, 19 May 2025 14:34:38 GMT

How do you know it isn't working? How are you using the token? Try updating the title (temporarily) to see if it changes?

<event> <title>$channel_token$</title> <search> <query>$case_token$ sourcetype=hayabusa $host_token$ $level_token$ $rule_token$ | fields Timestamp, host, Computer, Level, Channel, RecordID, EventID, Ruletitle, Details</query> </search> <fields>Timestamp, host, Computer, Level, Channel, RecordID, EventID, RuleTitle, Details, _time</fields> <option name="count">50</option> <option name="list.drilldown">none</option> <option name="list.wrap">1</option> <option name="raw.drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="table.drilldown">all</option> <option name="table.sortDirect">asc</option> <option name="table.wrap">1</option> <option name="type">table</option> <drilldown> <condition field="Channel"> <set token="channel_token">$click.value$</set> </condition> </drilldown> </event>

Re: Classic Dashboard Drilldown Click on a Value and Set Token

isoutamo — Mon, 19 May 2025 14:41:44 GMT

Have you add this

... script="simple_xml_examples:showtokens.js"

into your <form … > line?

With this addition you can see all defined tokens and their values.

Of course you must 1st install this app.