Hello,
I have a fieldset input checkbox type with many value for token (mvfield).
I would like to link with another dashboard with same checkbox.
First value $myCheckBox$ is string like this : "(field=val1 OR field=val2...)"
The second value of $form.myCheckBox$ is mvfield like this : "val1,val2..."
I tried in many different ways
<drilldown target="_blank">
<eval token="myCheckBox_link_token">mvjoin($form.myCheckBox$, "&form.myCheckBox=")</eval>
<set token="path" prefix="otherDashboard?form.myCheckBox=">$myCheckBox_link_token$</set>
<link>
<![CDATA[$path$]]>
</link>
</drilldown>
=> secureHTTP://mySplunk:port/fr-FR/app/MyApp/otherDashboard %3F form.myCheckBox %3D val1 %26 form.myCheckBox %3D val2
other test :
<drilldown target="_blank">
<eval token="myCheckBox_link_token">mvjoin($form.myCheckBox$, "&form.myCheckBox=")</eval>
<link>
<![CDATA[
otherDashboard?form.myCheckBox=$myCheckBox_link_token$&form.time_tok.earliest=$time_tok.earliest$&form.time_tok.latest=$time_tok.latest$
]]>
</link>
</drilldown>
=>secureHTTP://mySplunk:port/fr-FR/app/MyApp/otherDashboard?form.myCheckBox=val1 %26 form.myCheckBox *%3D * val2&form.time_tok.earliest=-15m&form.time_tok.latest=now
Exemple ok:
<drilldown target="_blank">
<link>
<![CDATA[otherDashboard?form.myCheckBox=val1&form.time_tok.earliest=$time_tok.earliest$&form.time_tok.latest=$time_tok.latest$]]>
</link>
</drilldown>
If I have a token with "&" or "=", can not link with another dashboard, it is automatically replaced by the values "% 26" or "% 3D".