Dashboards & Visualizations
Highlighted

Are tokens what I need to use in order to submit different drilldown searches based on what the user clicks on a trellised visualization?

Path Finder

I can't make heads nor tails of the Splunk docs for Token usage in dashboards

I have an index foo. Events in this index have a field bar that has one of two values: True or False

I have a dashboard with a panel that has a trellised (is split by bar), single value visualization. The search is index=foo | stats count by bar.

My goal is when the user clicks on the value under False, I want to open a new tab and run the drilldown search index=foo bar = "False", and when the user clicks on the value under True, I want to open a new tab and run the drilldown search index=foo bar = "True"

If tokens are what I need for my drilldown searches, how do I use them to accomplish my goal?

0 Karma
Highlighted

Re: Are tokens what I need to use in order to submit different drilldown searches based on what the user clicks on a trellised visualization?

Communicator

You will want to use tokens with a click event. Below is a good starting point. You will need to edit the xml.

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ContextualDrilldown

0 Karma
Highlighted

Re: Are tokens what I need to use in order to submit different drilldown searches based on what the user clicks on a trellised visualization?

Path Finder

As I mentioned in my question, I don't understand the docs on this topic. Perhaps you could provide an example that includes info concerning what dashboard element I need to edit. For example, your answer says "You will need to edit the xml." What XML? Where ? The docs are most unhelpful in this regard

0 Karma
Highlighted

Re: Are tokens what I need to use in order to submit different drilldown searches based on what the user clicks on a trellised visualization?

Communicator

You actually might not need to edit the xml depending on what you want to do. In your panel on the three dots you can select Edit Drilldown, next to the trellis. You would then want to link either to a report, dashboard or search of your choice. In this area you would connect the link and then the tokens you want to pass.

I have only linked dashboards and takes a bit of testing to get what you want potentially. Yours might look something like the following:

<drilldown>
          <set token="boolean">$click.name2$</set>
          <link target="_blank">search?q=index=foo bar=$boolean$</link>
        </drilldown>
      </chart>
    </panel>

When you click you set boolean to true or false; you might need to edit the "click.name*" see: https://docs.splunk.com/Documentation/Splunk/7.3.1/Viz/PanelreferenceforSimplifiedXML#Predefined_dri....

Then you pass the boolean value to the search in the target.

0 Karma
Highlighted

Re: Are tokens what I need to use in order to submit different drilldown searches based on what the user clicks on a trellised visualization?

Esteemed Legend

Token usage can be very confusing for the beginner. Here are 2 tips:
1: As much as possible, use the GUI.
2: Explore the Splunk Dashboard Exmaples app: https://splunkbase.splunk.com/app/1603/

0 Karma
Highlighted

Re: Are tokens what I need to use in order to submit different drilldown searches based on what the user clicks on a trellised visualization?

Legend

@williamcharlton0028 for trellis Splunk has provided two pre-defined drilldown tokens i.e. $trellis.name$ and $trellis.value$. Refer to Splunk Documentation: https://docs.splunk.com/Documentation/SplunkLight/latest/GettingStarted/Visualizationtrellis#Predefi...

You can also refer to one of my older answers for run anywhere example for $trellis.value$ : https://answers.splunk.com/answers/551802/how-can-i-get-drill-down-working-for-a-trellis-cha.html




| eval message="Happy Splunking!!!"


0 Karma