CONTEXT: I have a group of servers divided into several groups. From the top page, a user makes a choice from a dropdown to get to a dashboard with data from all servers in that group, and from the first drilldown, the user can choose (again from a dropdown) a specific server within the group to open a dashboard with logs specific to the chosen server.
The server lists and groups are fairly maleable, so I have set each of the top 2 dashboards to populate the dropdowns dynamically from a lookup table.
PROBLEM: When I open the top level dash, 1 to 3 of the 1st drilldown open (in new tabs) and either 3 or 9 of the second drilldown opens. This should happen until a choice is made.
top board:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="group_tok" searchWhenChanged="true">
<label>Bot Category</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host
| dedup group
| table group
</query>
</search>
<fieldForLabel>group</fieldForLabel>
<fieldForValue>group</fieldForValue>
<change>
<condition>
<link target="_blank">
drilldown1?group_tok=$group_tok$
</link>
</condition>
</change>
</input>
</fieldset>
1st drilldown:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="host_tok" searchWhenChanged="true">
<label>Bot</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host where group=$group_tok$
| table host
</query>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<change>
<condition>
<link target="_blank">drilldown2?host=$host_tok$</link>
</condition>
</change>
</input>
<input type="time" token="timepicker" searchWhenChanged="true">
<label>Search Time</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
Any idea why I'm getting these extra tabs opened without a choice actually being made? And why in batches of 3?
I've tried with autoRun=true and false, submitButton=true and false (obviously not at the same time for each) and I get the same behaviour.
not sure why the code didn't come through, let me try again:
top board:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="group_tok" searchWhenChanged="true">
<label>Bot Category</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host
| dedup group
| table group
</query>
</search>
<fieldForLabel>group</fieldForLabel>
<fieldForValue>group</fieldForValue>
<change>
<condition>
<link target="_blank">
drilldown1?group_tok=$group_tok$
</link>
</condition>
</change>
</input>
</fieldset>
1st drilldown:
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="host_tok" searchWhenChanged="true">
<label>Bot</label>
<!-- Dynamic definition of choices -->
<search>
<query>
| inputlookup group_ip_host where group=$group_tok$
| table host
</query>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<change>
<condition>
<link target="_blank">drilldown2?host=$host_tok$</link>
</condition>
</change>
</input>
<input type="time" token="timepicker" searchWhenChanged="true">
<label>Search Time</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
Instead of using change tag , you can use drilldown tag for displayinng other dashboards. This link may be of help-
https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/DrilldownLinkToDashboard
Also unset the tokens during initialization.