Dashboards & Visualizations

Eval varible doesnt work at drilldown xml

kennethyeung
New Member
       <eval token="t_contract">=strftime(now(), "%y%m")</eval>
      <link > <![CDATA[
      /app/search/option_change?form.tok_contract=$t_contract$
      ]]>
      </link>
    </drilldown>

it will go to anotherview but the link " /app/search/option_change?form.tok_contract=%3Dstrftime(now()%2C "%25y%25m")
seem that it dont know process before pass to link
also tried use " to quote in the URL, also not work.

Thanks

Tags (2)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @kennethyeung

I have tried below drilldown and it's working fine.

        <drilldown>
          <eval token="t_contract">strftime(now(), "%y%m")</eval>
                 <link > <![CDATA[
       /app/search/test1?form.test1token=$t_contract$
       ]]>
       </link>
        </drilldown>

Sample dashboard with drilldown working fine, in below dashboard I have another dashboard called test1 and that dashboard has Text Input field with token name test1token so when I redirect to another dashboard I got value 1712 in text input.

<form>
  <label>test</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="multiselect" token="field1" searchWhenChanged="false">
      <label>field1</label>
      <choice value="sourcetype">Sourcetype</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> </delimiter>
    </input>
    <input type="multiselect" token="field2">
      <label>field2</label>
      <choice value="host">Host</choice>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by $field1$, $field2$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <eval token="t_contract">strftime(now(), "%y%m")</eval>
                 <link > <![CDATA[
       /app/search/test1?form.test1token=$t_contract$
       ]]>
       </link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

View solution in original post

elliotproebstel
Champion

I'm pretty sure the issue is the = in your eval statement.

<eval token="t_contract">=strftime(now(), "%y%m")</eval>
should actually be
<eval token="t_contract">strftime(now(), "%y%m")</eval>

In the link: /app/search/option_change?form.tok_contract=%3Dstrftime(now()%2C "%25y%25m") the %3D between contract= and strftime is ASCII encoding for =.

kennethyeung
New Member

Thanks, i miss i have more = sign .

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @kennethyeung

I have tried below drilldown and it's working fine.

        <drilldown>
          <eval token="t_contract">strftime(now(), "%y%m")</eval>
                 <link > <![CDATA[
       /app/search/test1?form.test1token=$t_contract$
       ]]>
       </link>
        </drilldown>

Sample dashboard with drilldown working fine, in below dashboard I have another dashboard called test1 and that dashboard has Text Input field with token name test1token so when I redirect to another dashboard I got value 1712 in text input.

<form>
  <label>test</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="multiselect" token="field1" searchWhenChanged="false">
      <label>field1</label>
      <choice value="sourcetype">Sourcetype</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> </delimiter>
    </input>
    <input type="multiselect" token="field2">
      <label>field2</label>
      <choice value="host">Host</choice>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by $field1$, $field2$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <eval token="t_contract">strftime(now(), "%y%m")</eval>
                 <link > <![CDATA[
       /app/search/test1?form.test1token=$t_contract$
       ]]>
       </link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

kennethyeung
New Member

Is it related version issue?
I am using 7.0 and free version

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Let me try in Splunk 7, above code was test in Splunk 6.6

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Working perfectly fine in Splunk 7.0.1, please check again my drilldown code I have already removed =before strftime

0 Karma

kennethyeung
New Member

Thanks, i miss i have more = sign .

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @kennethyeung,

Can you please try to display form.tok_contract value in option_change dashboard? It is what you expected?

just add.

<row>
    <panel>
      <title>$form.tok_contract$</title>
    </panel>
</row>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...