All Apps and Add-ons

how to check drilldown token has some value ?

anjneesharma
New Member

in my dashboard i have multiple drill down at a time i want to show one table how can i check with token has some value and other's is null or empty i.e if token!=' ' how can i check this condition in splunk

0 Karma

woodcock
Esteemed Legend

You are going to FREAK OUT at how good this app is:

https://splunkbase.splunk.com/app/3689/

niketn
Legend

@anjneesharma easiest option is to print tokens in <title> for <panel> or any other visualization like <table><title> or <chart><title> etc.

Other option would be to create an html panel and print out the required tokens i.e.:

<row>
   <panel>
      <title>Panel for Debugging Token</title>
      <html>
                  <div>yourTokenOne: $yourTokenOne$</div>
                  <div>yourTokenTwo: $yourTokenTwo$</div>
                   ...
                   ...
                  <div>yourFinalToken: $yourFinalToken$</div>
      </html>
   </panel>
</row>

The tokens which are not set will show $$ token name instead of resolving to final value. Tokens set in search event handlers if remain unset then they show $result.fieldname$, instead of actual value implying search was not able to create the fieldname used in the search event handler.

Best option is to get Splunk Dashboard Examples app which has Token Viewer (Basic) and Dynamic Token Viewer examples using Splunk JS Stack to get the tokens changed in default and submitted token models.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

anjneesharma
New Member
<row>
    <panel>
   <search>
    <query>| makeresults |eval new_tok=case(len($OpenCR_tok$)>0,$OpenCR_tok$,(len($NewCR_tok$)>0,$NewCR_tok$,len($OnHoldCR_tok$)>0,$OnHoldCR_tok$) | table new_tok</query>
    <done>
    <set token="new12">$result.new_tok$</set>
    </done>
    </search>
    </panel>

    <panel depends="$new12$">\
                 // here drilldown table

This is my full requirement.

in new_tok i want to copy set or active token on based on that i want to display drilldown table.

0 Karma

niketn
Legend

@anjneesharma, I beg to differ as this does not seem to be your requirement, this seems to be your code.

Your requirement seems to be show the common panel with table on click of any Single Value visualization. If this is not please explain your requirement as in either case it will be different than your question/original post for which community members have already provided multiple options.

If your requirement is to show the same panel when any of the Single Value is clicked, you can add a new token new12, in each Single Value drilldown and set the same to true.

i.e. each <single><drilldown> section will have code similar to the following (keep the previous token, just add new12 token which is used in your <panel> with <table> later):

     <drilldown>
          <set token="CR_tok">$click.value$</set>
          <set token="new12">true</set>
     </drilldown>

PS: I dont think you need to explicitly call target="_self" in drilldown, which should be the default value.
Also <unset> before <set> is not required as it is redundant code.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @anjneesharma ,

If you want to display a table based on whether the token is set or not , you could use depends as mentioned in http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/tokens#Access_tokens_to_show_or_hide_user_inte...

If you have multiple tokens, then on drilldown , you could set/unset tokens you need , http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/tokens#Define_tokens_for_dynamic_drilldown

Below is a working example.

    <dashboard>
        <label>test</label>

        <row>

        <panel>
           <title>New CRs</title>
           <html class="html">
                     <div class="help-tip">  
                     <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
                     </div>
                 </html>
           <single>
             <search>
               <query>|`macro_ChangeRequest_JIRA`|search "CR State"="*"|table _time "Request item" "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
               <earliest>-48h</earliest>
               <latest>now</latest>
             </search>
             <option name="colorBy">value</option>
             <option name="colorMode">none</option>
             <option name="drilldown">all</option>
             <option name="height">80</option>
             <option name="linkView">search</option>
             <option name="numberPrecision">0</option>
             <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
             <option name="rangeValues">[0]</option>
             <option name="showSparkline">1</option>
             <option name="showTrendIndicator">1</option>
             <option name="trendColorInterpretation">standard</option>
             <option name="trendDisplayMode">absolute</option>
             <option name="underLabel">New CRs</option>
             <option name="unitPosition">before</option>
             <option name="useColors">1</option>
             <option name="useThousandSeparators">1</option>
             <option name="link.visible">0</option>
             <drilldown>
               <set token="common_token">$click.value2$</set>
             </drilldown>
           </single>
         </panel>

            <panel>
           <title>Open CRs</title>
           <html class="html">
                     <div class="help-tip">  
                     <p>This view provides the number of Open CRs and Drilldown table with information of the CRs.</p>
                     </div>
                 </html>
           <single>
             <search>
               <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Complete" "CR State"!="On Hold"|table _time "Request item" "CR State" "JIRA #" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
               <earliest>0</earliest>
               <latest></latest>
             </search>
             <option name="colorBy">value</option>
             <option name="colorMode">none</option>
             <option name="drilldown">all</option>
             <option name="height">80</option>
             <option name="linkView">search</option>
             <option name="numberPrecision">0</option>
             <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
             <option name="rangeValues">[0]</option>
             <option name="showSparkline">1</option>
             <option name="showTrendIndicator">1</option>
             <option name="trendColorInterpretation">standard</option>
             <option name="trendDisplayMode">absolute</option>
             <option name="underLabel">Open CRs</option>
             <option name="unitPosition">before</option>
             <option name="useColors">1</option>
             <option name="useThousandSeparators">1</option>
             <option name="link.visible">0</option>
             <drilldown >
               <set token="common_token">$click.value2$</set>
             </drilldown>
           </single>
         </panel>

             <panel>
           <title>Open Unassigned CRs</title>
           <html class="html">
                     <div class="help-tip">  
                     <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
                     </div>
                 </html>
           <single>
             <search>
               <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Complete"|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
               <earliest>0</earliest>
               <latest></latest>
             </search>
             <option name="colorBy">value</option>
             <option name="colorMode">none</option>
             <option name="drilldown">all</option>
             <option name="height">80</option>
             <option name="linkView">search</option>
             <option name="numberPrecision">0</option>
             <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
             <option name="rangeValues">[0]</option>
             <option name="showSparkline">1</option>
             <option name="showTrendIndicator">1</option>
             <option name="trendColorInterpretation">standard</option>
             <option name="trendDisplayMode">absolute</option>
             <option name="underLabel">Open Unassigned CRs</option>
             <option name="unitPosition">before</option>
             <option name="useColors">1</option>
             <option name="useThousandSeparators">1</option>
             <option name="link.visible">0</option>
             <drilldown >
               <set token="common_token">$click.value2$</set>
             </drilldown>
           </single>
         </panel>

              <panel>
           <title>On Hold CRs</title>
           <html class="html">
                     <div class="help-tip">  
                     <p>This view provides the number of open On Hold CRs and Drilldown table with information of the CRs.</p>
                     </div>
                 </html>
           <single>
             <search>
               <query>|`macro_ChangeRequest_JIRA`|search "CR State"="On Hold"|table _time  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
               <earliest>0</earliest>
               <latest></latest>
             </search>
             <option name="colorBy">value</option>
             <option name="colorMode">none</option>
             <option name="drilldown">all</option>
             <option name="height">80</option>
             <option name="linkView">search</option>
             <option name="numberPrecision">0</option>
             <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
             <option name="rangeValues">[0]</option>
             <option name="showSparkline">1</option>
             <option name="showTrendIndicator">1</option>
             <option name="trendColorInterpretation">standard</option>
             <option name="trendDisplayMode">absolute</option>
             <option name="underLabel">On Hold CRs</option>
             <option name="unitPosition">before</option>
             <option name="useColors">1</option>
             <option name="useThousandSeparators">1</option>
             <option name="link.visible">0</option>
             <drilldown >
               <set token="common_token">$click.value2$</set>
             </drilldown>
           </single>
         </panel>



          <panel>
           <title>Pending for CAB Approval</title>
           <html class="html">
                     <div class="help-tip">  
                     <p>This view provides the CR'S which are in Pending status for CAB Approval.</p>
                     </div>
                 </html>
           <single>
             <search>
               <query>|`macro_ChangeRequest_JIRA`|search "CR State"="Internal CAB - Estimates for Review/Approval"|table  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
               <earliest>0</earliest>
               <latest></latest>
               <refresh>48h</refresh>
               <refreshType>delay</refreshType>
             </search>
             <option name="colorBy">value</option>
             <option name="colorMode">none</option>
             <option name="drilldown">all</option>
             <option name="height">80</option>
             <option name="linkView">search</option>
             <option name="numberPrecision">0</option>
             <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
             <option name="rangeValues">[0]</option>
             <option name="showSparkline">1</option>
             <option name="showTrendIndicator">1</option>
             <option name="trendColorInterpretation">standard</option>
             <option name="trendDisplayMode">absolute</option>
             <option name="underLabel">Pending For CAB Approval</option>
             <option name="unitPosition">before</option>
             <option name="useColors">1</option>
             <option name="useThousandSeparators">1</option>
             <option name="link.visible">0</option>
             <drilldown >
               <set token="common_token">$click.value2$</set>
             </drilldown>
           </single>
         </panel>

          <panel>
            <title>Third Token</title>
            <single>
              <search>
                <query>|makeresults|eval third_token="Sharma"</query>
                <earliest>-15m</earliest>
                <latest>now</latest>
              </search>
              <option name="drilldown">all</option>
              <drilldown>
                <set token="common_token">$click.value2$</set>
              </drilldown>
            </single>
          </panel>

        </row>


        <row>
          <panel>
            <html>
            <p1> General : $common_token$</p1>
          </html>
          </panel>
        </row>


        <row>
         <panel depends="$common_token$">
           <input type="checkbox" token="tokReset" searchWhenChanged="true">
             <label></label>
             <change>
               <unset token="common_token"></unset>
               <unset token="form.tokReset"></unset>
             </change>
             <choice value="hide">Hide Details</choice>
             <delimiter> </delimiter>
           </input>
           <table>
             <title>$common_token$</title>
             <search>
             <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" reated "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="*"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
               <earliest>-48h</earliest>
               <latest>now</latest>
             </search>
             <option name="drilldown">none</option>
             <option name="link.visible">0</option>
           </table>
         </panel>
       </row>
      </dashboard>
Happy Splunking!
0 Karma

anjneesharma
New Member

Thanks a lot your timely answer.

My concert is that i have multiple token and i am not aware of that which toke is set or unset based on that i want to pass already setted token to depends.
Could you please help me how can i check token is set or unset status ?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @anjneesharma ,

The easiest method is to set the same token for all these three and set the panel and also the search result in the panel based on this token.

For e.g.

  • Set the token $CR_tok$ on the set token for open/new/onhold CRs
  • Set depends=$CR_tok$ for the table panel to display
  • In the search query of the panel, just include this token to select the data

We have done something similar on based on the sourcetype filter. Please lets know if you have any other constraint on this

Happy Splunking!
0 Karma

anjneesharma
New Member

Hi @renjith.nair

I tried bellow one but it displaying me same result always not changing if i will click on different single value chart.

    <panel>
      <title>New CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"="*"|table _time "Request item" "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>-48h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">New CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown target="_self">
          <unset token="CR_tok"></unset>
         <set token="CR_tok">$click.value$</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>Open CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the number of Open CRs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Complete" "CR State"!="On Hold"|table _time "Request item" "CR State" "JIRA #" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Open CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown target="_self">

          <set token="CR_tok">$click.value$</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>Open Unassigned CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Complete"|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Open Unassigned CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown target="_self">

          <set token="CR_tok">$click.value$</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>On Hold CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the number of open On Hold CRs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"="On Hold"|table _time  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">On Hold CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown target="_self">

          <set token="CR_tok">$click.value$</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>Pending for CAB Approval</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the CR'S which are in Pending status for CAB Approval.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"="Internal CAB - Estimates for Review/Approval"|table  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
          <refresh>48h</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Pending For CAB Approval</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown target="_self">

          <set token="CR_tok">$click.value$</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$CR_tok$">
      <input type="checkbox" token="tokReset1" searchWhenChanged="true">
        <label></label>
        <change>
          <unset token="CR_tok"></unset>
          <unset token="form.tokReset1"></unset>
        </change>
        <choice value="hide">Hide Details</choice>
        <delimiter> </delimiter>
      </input>
      <table>
        <title>CRs details</title>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" reated "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="*"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
          <earliest>-48h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">1</option>
      </table>
    </panel>
  </row>
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @anjneesharma,

Please find below the anywhere running example where click on each single value sets the corresponding token. Please have a look and let's know if this suits your requirement,

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <title>First Token</title>
      <single>
        <search>
          <query>|makeresults|eval first_token="first_token"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="common_token">$click.value$</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>Second Token</title>
      <single>
        <search>
          <query>| makeresults |eval second_token="second_token"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="common_token">$click.value$</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>Third Token</title>
      <single>
        <search>
          <query>|makeresults|eval third_token="third_token"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="common_token">$click.value$</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <p1> General : $common_token$</p1>
    </html>
    </panel>
  </row>
</dashboard>
Happy Splunking!
0 Karma

anjneesharma
New Member

Hi @renjith.nair

your example is working perfectly but my drill down table search showing every time same result. Plz help me why its not updated according to recent token set

<dashboard>
   <label>test</label>

   <row>

   <panel>
      <title>New CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"="*"|table _time "Request item" "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>-48h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">New CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown target="_self">
          <set token="common_token">$click.value$</set>
        </drilldown>
      </single>
    </panel>

       <panel>
      <title>Open CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the number of Open CRs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Complete" "CR State"!="On Hold"|table _time "Request item" "CR State" "JIRA #" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Open CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown >
          <set token="common_token">$click.value$</set>
        </drilldown>
      </single>
    </panel>

        <panel>
      <title>Open Unassigned CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the New CRs in the last 48 hrs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"!="Closed Skipped (Rejected)" "CR State"!="Closed Incomplete (Cancelled)" "CR State"!="Closed Complete"|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Open Unassigned CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown >
          <set token="common_token">$click.value$</set>
        </drilldown>
      </single>
    </panel>

         <panel>
      <title>On Hold CRs</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the number of open On Hold CRs and Drilldown table with information of the CRs.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"="On Hold"|table _time  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">On Hold CRs</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown >
          <set token="common_token">$click.value$</set>
        </drilldown>
      </single>
    </panel>



     <panel>
      <title>Pending for CAB Approval</title>
      <html class="html">
                <div class="help-tip">  
                <p>This view provides the CR'S which are in Pending status for CAB Approval.</p>
                </div>
            </html>
      <single>
        <search>
          <query>|`macro_ChangeRequest_JIRA`|search "CR State"="Internal CAB - Estimates for Review/Approval"|table  "CR State" Created|eval _time=coalesce(strptime('Created',"%Y-%m-%d"),strptime('Created', "%d-%b-%y")) |timechart span=1w count|streamstats sum(count) as "count"</query>
          <earliest>0</earliest>
          <latest></latest>
          <refresh>48h</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="height">80</option>
        <option name="linkView">search</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x65a637","0x6db7c6"]</option>
        <option name="rangeValues">[0]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="underLabel">Pending For CAB Approval</option>
        <option name="unitPosition">before</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
        <option name="link.visible">0</option>
        <drilldown >
          <set token="common_token">$click.value$</set>
        </drilldown>
      </single>
    </panel>

     <panel>
       <title>Third Token</title>
       <single>
         <search>
           <query>|makeresults|eval third_token="Sharma"</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
         <option name="drilldown">all</option>
         <drilldown>
           <set token="common_token">$click.value$</set>
         </drilldown>
       </single>
     </panel>

   </row>


   <row>
     <panel>
       <html>
       <p1> General : $common_token$</p1>
     </html>
     </panel>
   </row>


   <row>
    <panel depends="$common_token$">
      <input type="checkbox" token="tokReset" searchWhenChanged="true">
        <label></label>
        <change>
          <unset token="common_token"></unset>
          <unset token="form.tokReset"></unset>
        </change>
        <choice value="hide">Hide Details</choice>
        <delimiter> </delimiter>
      </input>
      <table>
        <title>$common_token$</title>
        <search>
        <query>|`macro_ChangeRequest_JIRA`|fields "CR State" "PO/PM" "Request item" reated "Created By" "Requestor Country" Application "PO/PM"|rename "Requestor Country" as Region|search "CR State"="*"|rename "Request item" as RequestItem|fillnull value="Not Available"|table RequestItem "CR State" "PO/PM" Application Region</query>
          <earliest>-48h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="link.visible">0</option>
      </table>
    </panel>
  </row>
 </dashboard>
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Added to the answer

Happy Splunking!
0 Karma

anjneesharma
New Member

Hi @renjith.nair

I tried it its working fine which ever CR i am clicking first if i will click on another CR it will not display clicked one it will display same old one.
Example:- if i clicked on NewCr it will display properly if i will display on OpenCr it will keep on displaying same NewCr only

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...