Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Classic Dashboard HTML Link with Tokens
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Classic Dashboard HTML Link with Tokens
I have a Classic Dashboard where I have an HTML panel. I am trying to link to another dashboard with tokens that the user can select via multiselects. However, it isn't working. This is my HTML panel:
<row>
<panel>
<html><div>
<a target="_blank" href=/app/app/operating_system?form.case_token=$case_token$&form.host_name=$host_name$">Operating System Artifacts</a>
</div></html>
</panel>
</row>- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I made a typo in my post, so here is the actual version. Thank you in advance for your help!
<row>
<panel>
<html><div>
<a target="_blank" href="/app/app/operating_system?form.case_token=$case_token$&form.host_name=$host_name$">Operating System Artifacts</a>
</div></html>
</panel>
</row>- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please provide more information - what do you mean by "not working"? What does the rest of your dashboard look like? What does your target dashboard look like?
I have not been able to reproduce the issue from the limited information you have provided, however, I have created a dashboard with tokens making up a link in an HTML panel which does work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is the initial dashboard:
<form version="1.1" theme="dark">
<label>Case Overview</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="case_token" searchWhenChanged="true">
<label>Case Selector</label>
<prefix>index=virtuoso_</prefix>
<suffix>*</suffix>
<fieldForLabel>case</fieldForLabel>
<fieldForValue>case</fieldForValue>
<search>
<query>| tstats count where index=index_* by index
| rex field=index "\_(?<case>.*?)\_"
| dedup case
| table case</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
<input type="time" token="global_time">
<label>Global Time Range</label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<input type="dropdown" token="host_token" searchWhenChanged="true">
<label>Host</label>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>| tstats count where $case_token$ by host
| table host</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
</fieldset>
<row>
<panel>
<html><div>
<a target="_blank" href="/app/app/operating_system_artifacts?case_token=$case_token$&host_name=$host_name$"><h1>Operating System Artifacts</h1></a>
</div></html>
</panel>
</row>
</form>Here is the connecting dashboard:
<dashboard version="1.1" theme="dark">
<label>Operating System Artifacts</label>
<row>
<panel>
<html encoded="1"><h1>Prefetch</h1></html>
</panel>
</row>
<row>
<panel>
<table>
<title>Prefetch Files</title>
<search>
<query>$case_token$ host=$host_token$
| table ApplicationPath, LastRun, TimesRan</query>
<earliest>$global_time.earliest$</earliest>
<latest>$global_time.latest$</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="ApplicationPath">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
</row>
</dashboard>- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It brings me to the next dashboard, but the tokens aren't set.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can't set tokens like this, they should be tokens from an input. Try something like this
<a target="_blank" href="/app/app/operating_system_artifacts?form.case_token=$case_token$&form.host_name=$host_name$"><h1>Operating System Artifacts</h1></a>And convert your target dashboard to a form and add a couple of hidden text inputs
<row>
<panel>
<input type="text" token="case_token" depends="$alwaysHide$"></input>
<input type="text" token="host_name" depends="$alwaysHide$"></input>
<html encoded="1"><h1>Prefetch</h1></html>
</panel>
</row>- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did this, but it still doesn't work. When I click on the link, this is the URL that flashes:
/apps/apps/operating_system_artifacts?form.case_token=index=index_burns*&form.host_name=$host_name$
Then, immediately after, it changes to:
/apps/apps/operating_system_artifacts?form.case_token=index&form.host_name=%24host_name%24
Do you think the issue could be how the multi-select token works?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You aren't using multi-selects, you are using dropdowns, these are different types of inputs. Anyway, that probably isn't your issue. Try encoding the tokens for use in an URL (with the |u modifier)
<a target="_blank" href="/app/app/operating_system_artifacts?case_token=$case_token|u$&host_name=$host_name|u$"><h1>Operating System Artifacts</h1></a>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect, that worked for the URL and setting the tokens. However, the search on the second dashboard (operating system), still says "Search is waiting for input..."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your second dashboard doesn't have a global_time input - probably waiting for that to be set?
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
