How do I get a drilldown from <link target> (url...

Splunk_noobie · ‎03-17-2022

Hi Team,

I have a dashboard, where when I click on a row, it drills down to another URL for a different dashboard.

Now I want to capture this URL that it's using in drilldown and store it in a token. How do I do it?

My sample code :

 <row>
    <panel depends="$drilldown_display$">
      <table>
        <title>Top RequestIds for $eptok$</title>
        <search>
          <query>$instance_select$ organizationId=CASE($organizationId$) earliest=$earliest$ latest=$latest$ sourcetype=CASE(applog*:axapx) [search $instance_select$ organizationId=CASE($organizationId$) earliest=$earliest$ latest=$latest$ sourcetype=CASE(applog*:gslog) "CPU_ENFORCED"| stats count by requestId | fields requestId | format ]  entryPoint="$eptok$" | table requestId runTime | sort -runTime</query>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="drilldown_display1">block</set>
          <set token="reqtok">$row.requestId$</set>
          <link target="_blank">https://splunk-web.monitoring.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$reqtok$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>

IF you see the above code, I am drilling to Dashboard_second based on the row I click.
I want to capture this URL for Dashboard_second in a token and display it in my HTML Panel.
How do we achieve this ?

My HTML Panel code :

    <panel>
      <html>
        <h1 class="SectionHeader">Panel to display drilldown URL </h1>
        <div style="float:left; width:calc(95% - 60px);" class="pageInfo">
          <pre>
===========INTERNAL==============

<b>DrillDown URL :  </b> $MyUrl$ 

===========INTERNAL==============
  </pre>  
        </div>
      </html>
    </panel>

Splunk_noobie · ‎03-17-2022

@gcusello
The ideal output should look like this

===========INTERNAL==============

Drilldown URL :  

https://splunk-web.monitoring.com/en-US/app/publicSharing/Dashboard_second?form.instance=am55&amp;form.orgId=00T76000000RTY&amp;form.requestId=TID:d56153hk78600

https://splunk-web.monitoring.com/en-US/app/publicSharing/Dashboard_second?form.instance=am55&amp;form.orgId=00T76000000RTY&amp;form.requestId=TID:mt00952y3rt098
===========INTERNAL==============

I made clicks on two rows and these two urls are populated with different requestID (check the URL ending part)

gcusello · ‎03-17-2022

Hi @Splunk_noobie,

if the dashboard changes depending on the clicked row, you could add the dashboard value using a lookup containing the dashboard, I did it.

Ciao.

Giuseppe

Splunk_noobie · ‎03-17-2022

@gcusello

Please find the below code. I was successfully able to generate the URL in my template but the requestId is still not being populated. But org id and instance and other ids are getting populated. Why is $row.requestId$ not being populated ?

  <row>
    <panel>
      <title>Statistics by Entrypoint</title>
      <table>
        <title>Please select Rows having high CPU Time</title>
        <search>
          <query>$instance_select$ CASE($organizationId$) earliest=$earliest$ latest=$latest$ `logRecordType(axapx)` [search $instance_select$ CASE($organizationId$) earliest=$earliest$ latest=$latest$ `logRecordType(gslog)` "CPU_ENFORCED"| stats count by requestId | fields requestId | format ] | stats count by entryPoint, userId | sort -count | streamstats count as Sr.No. | fields Sr.No., entryPoint, userId, count </query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <format type="color" field="errorThresholdCount">
          <colorPalette type="list">[#FFFFFF,#53A051,#DC4E41]</colorPalette>
          <scale type="threshold">0,1</scale>
        </format>
        <drilldown target="_blank">
          <set token="eptok">
            <![CDATA[$row.entryPoint$]]>
          </set>
          <set token="drilldown_display">block</set>
          <eval token="earliest_str">$row.earliest_str$</eval>
          <eval token="latest_str">$row.latest_str$</eval>
          <eval token="earliest_str">$row.earliest$</eval>
          <eval token="tempEarliest">$earliest$-19800</eval>
          <!-- Temp converting IST to UTC -->
          <eval token="earliestUTC">if(isnull($earliestUTC$), strftime($tempEarliest$,"%m/%d/%y %H:%M:%S") , $earliestUTC$)</eval>
          <eval token="latest_str">$row.latest$</eval>
          <eval token="tempLatest">$latest$-19800</eval>
          <!-- Temp converting IST to UTC -->
          <eval token="latestUTC">if(isnull($latestUTC$), strftime($tempLatest$,"%m/%d/%y %H:%M:%S"), $latestUTC$)</eval>
          <set token="SeverityTok">$severity$</set>
          <set token="eptok">$row.entryPoint$</set>
          <set token="epUserId">$row.userId$</set>
          <set token="Count">$row.count$</set>
          <set token="errorThresholdCount">$row.errorThresholdCount$</set>
          <set token="epAvgTime">$row.averageRunTime$</set>
          <set token="epMaxTime">$row.maxRunTime$</set>
          <set token="epAvgcpuTime">$row.averageCpuTime$</set>
          <set token="epMaxcpuTime">$row.maxCpuTime$</set>
          <set token="epAvgDbtime">$row.averageDbTotalTime$</set>
          <set token="epMaxDbtime">$row.maxDbTotalTime$</set>
          <eval token="entrypoint_detail">if(isnull($entrypoint_detail$),"
[".$row.Sr.No.$."] 
EntryPoint : ".$row.entryPoint$."
UserId: ".$row.userId$."
Count : ".$row.count$." 
",$entrypoint_detail$."
[".$row.Sr.No.$."] 
EntryPoint : ".$row.entryPoint$."
UserId: ".$row.userId$."
Count : ".$row.count$."
")</eval>

<eval token="perfDashUrl"> if(isnull($perfDashUrl$),"
.
",$perfDashUrl$."
Performance Dashboard URL : ".$row.dashboard_url$." 
") </eval> 


        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$drilldown_display$">
      <table>
        <title>Top RequestIds for $eptok$</title>
        <search>
          <query>$instance_select$ organizationId=CASE($organizationId$) earliest=$earliest$ latest=$latest$ sourcetype=CASE(applog*:axapx) [search $instance_select$ organizationId=CASE($organizationId$) earliest=$earliest$ latest=$latest$ sourcetype=CASE(applog*:gslog) "CPU_ENFORCED"| stats count by requestId | fields requestId | format ]  entryPoint="$eptok$" | eval dashboard_url="https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$" | table requestId runTime dashboard_url | fields requestId runTime <!-- &amp;form.requestId=$reqtok$ -->
| sort -runTime</query>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="drilldown_display1">block</set>
          <set token="reqtok">$row.requestId$</set>
          <set token="abc">$row.requestId$</set>
          <eval token="perfDashUrl">if(isnull($perfDashUrl$),"
Performance Dashboard URL : https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$row.requestId$
",$perfDashUrl$."
Performance Dashboard URL : https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$row.requestId$
")</eval>
          <link target="_blank">https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$reqtok$</link>
        </drilldown>
      </table>
    </panel>
  </row>

  <row>
    <panel depends="$drilldown_display$">
      <!-- Customer suggestions -->
      <html>
        <h1 class="SectionHeader">INTERNAL COMMENTS </h1>
        <div style="float:left; width:calc(95% - 60px);" class="pageInfo">
          <pre>
===========INTERNAL==============

<b>Dashboard URL : </b> https://splunk-web.com/en-US/app/publicSharing/timeout_exception_v1?earliest=$earliest$&amp;latest=$latest$&amp;form.instance=$instance$&amp;form.organizationId=$organizationId$&amp;form.userId=*&amp;form.entityType=*&amp;form.verb=*&amp;form.span=1h&amp;severity=$severity$

<b>Performance Dashboard url : </b> $perfDashUrl$

===========INTERNAL==============
  </pre>  
        </div>
      </html>
    </panel>
  </row>

Current OutPut is :

===========INTERNAL==============

Performance Dashboard URL : https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=UP55&form.orgId=00T63518gtwie44&form.requestId=$row.requestId$

Performance Dashboard URL : https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=UP55&form.orgId=00T63518gtwie44&form.requestId=$row.requestId$


===========INTERNAL==============?

Please help me with requestId=$row.requestId$ 😞

gcusello · ‎03-17-2022

Hi @Splunk_noobie,

in the last drilldown, try this:

 <link target="_blank">https://splunk-web.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$row.requestId$</link>

Anyway, the problem is surely in the value of the field: one time you used "form.requestId=$reqtok$" and one time you used "form.requestId=$row.requestId$".

In addition I don't like to use "form.token_name", I prefer to use only "token_name".

Ciao.

Giuseppe

Splunk_noobie · ‎03-17-2022

@gcusello

let me understand: you want to put the secondary dashboard URL in a token and pass it to another panel of the same dashboard, is it correct? -------- YES, you are right. The intention here is to put the secondary dashboard URL in a token and pass it to another panel

But I see that you have hardcoded the URL in the code. The URL keeps changing based on the row I click.

If you see below, the requestId is picked dynamically from the current row and stored in $reqtok$ . So I want all these URLs passed to HTML panel as I click each row.

https://splunk-web.monitoring.com/en-US/app/publicSharing/Dashboard_second?form.instance=$instance$&amp;form.orgId=$organizationId$&amp;form.requestId=$reqtok$

gcusello · ‎03-17-2022

Hi @Splunk_noobie,

let me understand: you want to put the secondary dashboard url in a token and pass it to another panel of the same dashboard, is it correct?

You could put the dashboard url in a field of your search, so you can use it on click, something like this:

<row>
    <panel depends="$drilldown_display$">
      <table>
        <title>Top RequestIds for $eptok$</title>
        <search>
          <query>
              $instance_select$ organizationId=CASE($organizationId$) earliest=$earliest$ latest=$latest$ sourcetype=CASE(applog*:axapx) [search $instance_select$ organizationId=CASE($organizationId$) earliest=$earliest$ latest=$latest$ sourcetype=CASE(applog*:gslog) "CPU_ENFORCED" | stats count by requestId | fields requestId | format ]  entryPoint="$eptok$" 
              | eval dashboard_url="https://splunk-web.monitoring.com/en-US/app/publicSharing/Dashboard_second"
              | table requestId runTime dashboard_url
              | sort -runTime 
          </query>
        </search>
        <fields>requestId, runTime</fields>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="drilldown_display1">block</set>
          <set token="reqtok">$row.requestId$</set>
          <link target="_blank">$row.dashborda_url$?instance=$instance$&amp;orgId=$organizationId$&amp;requestId=$reqtok$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>

In other words I have inserted the dashboard_url value in a field displayed in the search rgat you can use in drilldown, but I don't display it in the outputs using the <fields> option.

I don't know it it runs because I cannot test it but it should!

Ciao.

Giuseppe

Splunk_noobie · ‎03-17-2022

@gcusello Any thoughts?

How do I get a drilldown from <link target> (url) in a token?

drilldown

panel

simple XML

token

Announcing Scheduled Export GA for Dashboard Studio

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!