<eval token="t_contract">=strftime(now(), "%y%m")</eval>
<link > <![CDATA[
/app/search/option_change?form.tok_contract=$t_contract$
]]>
</link>
</drilldown>
it will go to anotherview but the link " /app/search/option_change?form.tok_contract=%3Dstrftime(now()%2C "%25y%25m")
seem that it dont know process before pass to link
also tried use " to quote in the URL, also not work.
Thanks
Hi @kennethyeung
I have tried below drilldown and it's working fine.
<drilldown>
<eval token="t_contract">strftime(now(), "%y%m")</eval>
<link > <![CDATA[
/app/search/test1?form.test1token=$t_contract$
]]>
</link>
</drilldown>
Sample dashboard with drilldown working fine, in below dashboard I have another dashboard called test1
and that dashboard has Text Input field with token name test1token
so when I redirect to another dashboard I got value 1712
in text input.
<form>
<label>test</label>
<fieldset submitButton="true" autoRun="false">
<input type="multiselect" token="field1" searchWhenChanged="false">
<label>field1</label>
<choice value="sourcetype">Sourcetype</choice>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<delimiter> </delimiter>
</input>
<input type="multiselect" token="field2">
<label>field2</label>
<choice value="host">Host</choice>
<delimiter> </delimiter>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal | stats count by $field1$, $field2$</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<drilldown>
<eval token="t_contract">strftime(now(), "%y%m")</eval>
<link > <![CDATA[
/app/search/test1?form.test1token=$t_contract$
]]>
</link>
</drilldown>
</table>
</panel>
</row>
</form>
I'm pretty sure the issue is the =
in your eval statement.
<eval token="t_contract">=strftime(now(), "%y%m")</eval>
should actually be
<eval token="t_contract">strftime(now(), "%y%m")</eval>
In the link: /app/search/option_change?form.tok_contract=%3Dstrftime(now()%2C "%25y%25m")
the %3D
between contract=
and strftime
is ASCII encoding for =
.
Thanks, i miss i have more = sign .
Hi @kennethyeung
I have tried below drilldown and it's working fine.
<drilldown>
<eval token="t_contract">strftime(now(), "%y%m")</eval>
<link > <![CDATA[
/app/search/test1?form.test1token=$t_contract$
]]>
</link>
</drilldown>
Sample dashboard with drilldown working fine, in below dashboard I have another dashboard called test1
and that dashboard has Text Input field with token name test1token
so when I redirect to another dashboard I got value 1712
in text input.
<form>
<label>test</label>
<fieldset submitButton="true" autoRun="false">
<input type="multiselect" token="field1" searchWhenChanged="false">
<label>field1</label>
<choice value="sourcetype">Sourcetype</choice>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<delimiter> </delimiter>
</input>
<input type="multiselect" token="field2">
<label>field2</label>
<choice value="host">Host</choice>
<delimiter> </delimiter>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal | stats count by $field1$, $field2$</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<drilldown>
<eval token="t_contract">strftime(now(), "%y%m")</eval>
<link > <![CDATA[
/app/search/test1?form.test1token=$t_contract$
]]>
</link>
</drilldown>
</table>
</panel>
</row>
</form>
Is it related version issue?
I am using 7.0 and free version
Let me try in Splunk 7, above code was test in Splunk 6.6
Working perfectly fine in Splunk 7.0.1, please check again my drilldown code I have already removed =
before strftime
Thanks, i miss i have more = sign .
HI @kennethyeung,
Can you please try to display form.tok_contract
value in option_change
dashboard? It is what you expected?
just add.
<row>
<panel>
<title>$form.tok_contract$</title>
</panel>
</row>