Dashboards & Visualizations

Can I pass multiple values defined in a fieldset tag using drilldown and simple XML?

oshi
Engager

Disclaimer: Very new to Splunk.
Can I pass multiple values defined in a fieldset tag using drilldown and simple XML, or do I need to learn advanced xml for this functionality?
Every attempt I've made to pass a second value in a drilldown link (eg ../?form.token1=$value1$&form.token2=$value2$) just passes it through as written instead of the value it represents.
I have a workflow where a user is identified (by name or ip address) in order to locate the identifier of the transaction, which is used to locate all events related with that user's actions within the system (not all of which include their user name in the event).
However, the data is coming from multiple servers, and the identifiers periodically roll over so I'd like to be able to pass host and time information along with transaction id.
Thanks!

Labels (2)
0 Karma
1 Solution

oshi
Engager

The & symbol is a reserved XML character (which was the problem), but it turns out it that the ASCII identities work as expected and allow you to pass more than one token if used between values (eg /..?form.value1=$row.value1$&form.value2=$row.value2$). I thought I'd tried this yesterday, but I guess I had done it wrong. The ascii code for & is (without the space) & amp; or & #38;

View solution in original post

Kamal95
Engager

I tried it and it worked in single try, Thank you so much.

0 Karma

oshi
Engager

The & symbol is a reserved XML character (which was the problem), but it turns out it that the ASCII identities work as expected and allow you to pass more than one token if used between values (eg /..?form.value1=$row.value1$&form.value2=$row.value2$). I thought I'd tried this yesterday, but I guess I had done it wrong. The ascii code for & is (without the space) & amp; or & #38;

mukesh_gupta
Explorer

thanks man it worked for me.

0 Karma

ankurborah
Path Finder

Thanks Oshi. Its working for me too.

0 Karma

Leo
Splunk Employee
Splunk Employee

oshi, try using $form.< token>$ instead:

form.token1=$form.name$&form.token2=$form.ip$

also, you can use values from the row on which you clicked:

form.value1=$row.field1$&form.value2=$row.field2$

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...