Dynamically pass SPL to events panel on dashboard

[dstuder]

I have a dashboard with four pie charts across the top. I've set up drill downs for these that open up a new tab. However, I'm wondering if it is possible to put and events panel below them and depending upon the pie chart that is clicked dynamically build the SPL for the events panel. The four pie charts have very different searches and drill downs, so I cannot simply just populate some tokens for use with the events panel. I would need to actually dynamically build the SPL and pass that to the events panel. Is that even possible? Thanks.

[VatsalJagani · Accepted solution]

Please see below the code of simple XML dashboard:

- I've used table as below panels instead of events, but you could use events.

- In my case all data are generated with makeresults command for testing.

<dashboard>
  <label>Test_Dashboard</label>
  <row>
    <panel>
      <title>1</title>
      <single>
        <search>
          <query>| makeresults | eval count="1" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>2</title>
      <single>
        <search>
          <query>| makeresults | eval count="2" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>3</title>
      <single>
        <search>
          <query>| makeresults | eval count="3" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
    <panel>
      <title>4</title>
      <single>
        <search>
          <query>| makeresults | eval count="4" | table count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">all</option>
        <drilldown>
          <set token="events_panel_spl">| makeresults | eval _raw="You have selected ".$click.value|s$."."</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Events panel</title>
      <table>
        <search>
          <query>$events_panel_spl$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

- See use of <drilldown> and <set> with single view and I've generated the whole SPL inside the token and I'm then just using that token ($events_panel_spl$) as whole search query.

[dstuder]

Odd. I tried that first and it wasn't working. I must have had something wrong with the syntax that I was not seeing. Anyway, thanks. That is doing what I want.