I can't make heads nor tails of the Splunk docs for
Token usage in dashboards
I have an index
foo. Events in this index have a field
bar that has one of two values:
I have a dashboard with a panel that has a trellised (is split by
bar), single value visualization. The search is
index=foo | stats count by bar.
My goal is when the user clicks on the value under
False, I want to open a new tab and run the drilldown search
index=foo bar = "False", and when the user clicks on the value under
True, I want to open a new tab and run the drilldown search
index=foo bar = "True"
If tokens are what I need for my drilldown searches, how do I use them to accomplish my goal?
As I mentioned in my question, I don't understand the docs on this topic. Perhaps you could provide an example that includes info concerning what dashboard element I need to edit. For example, your answer says "You will need to edit the xml." What XML? Where ? The docs are most unhelpful in this regard
You actually might not need to edit the xml depending on what you want to do. In your panel on the three dots you can select Edit Drilldown, next to the trellis. You would then want to link either to a report, dashboard or search of your choice. In this area you would connect the link and then the tokens you want to pass.
I have only linked dashboards and takes a bit of testing to get what you want potentially. Yours might look something like the following:
<drilldown> <set token="boolean">$click.name2$</set> <link target="_blank">search?q=index=foo bar=$boolean$</link> </drilldown> </chart> </panel>
When you click you set boolean to true or false; you might need to edit the "click.name*" see: https://docs.splunk.com/Documentation/Splunk/7.3.1/Viz/PanelreferenceforSimplifiedXML#Predefined_dri....
Then you pass the boolean value to the search in the target.
@williamcharlton0028 for trellis Splunk has provided two pre-defined drilldown tokens i.e.
$trellis.value$. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/SplunkLight/latest/GettingStarted/Visualizationtrellis#Predefi...
You can also refer to one of my older answers for run anywhere example for
$trellis.value$ : https://answers.splunk.com/answers/551802/how-can-i-get-drill-down-working-for-a-trellis-cha.html