Dashboards & Visualizations

Can you use a token from one dashbaord in another dashboard that's linked to it?

madisonf15
Engager

I have two simple xml dashbaords: a high level dashbord and a low level dashbaord. I have 4 filters on the high level (system code filter, subsystem filter, time range filter, and a call type filter) that affect all of the panels. You can get to the low level dashbaord by clicking on a single-value panel on the high level. I'm using the token "$syscode_tok$" to reference the single value (let's say it's -513) in my low level dashboard. So whenever I want to extract data that contains the single-value -513 in my low level dhasboard, I just use my $syscode_tok$. However, I was wondering if there was a way to reference the other 4 filters I have on my high-level. I tried setting the default on my low level to be the $syscode_tok$, but that just gives me the -513. Is there a way to get the 4 tokens I have on my high level to my low level?

Tags (1)
0 Karma

kbarker302
Communicator

Are you trying to achieve something like this? I only have two dropdowns in my example, but the key is the link statement in the drilldown for the single value:

<form>
  <label>Dashboard - Link to second dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <choice value="1">Choice 1</choice>
      <choice value="2">Choice 2</choice>
      <choice value="3">Choice 3</choice>
      <default>1</default>
    </input>
    <input type="dropdown" token="field2">
      <choice value="1">Choice 1</choice>
      <choice value="2">Choice 2</choice>
      <choice value="3">Choice 3</choice>
      <default>1</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_audit | stats count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <link>/app/sandbox/second_dashboard?field1=$field1$&amp;field2=$field2$</link>
        </drilldown>
      </single>
    </panel>
  </row>
</form>

Then in the "receiving" or low level dashboard, you should be able to reference the tokens passed on the query string:

<dashboard>
  <label>Second Dashboard</label>
  <row>
  <html>
    <div>
      Field 1: $field1$<br/>
      Field 2: $field2$
    </div>
  </html>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...