Dashboards & Visualizations

How do I pass one dashboard date/time picker through drilldown to a second dashboard?

mcrawford44
Communicator

I have the following drilldown configuration in a dashbaord;

        <drilldown target="My New Window">
          <link field="user">
            <![CDATA[https://foo.com/en-US/app/appname/dashboardname?form.egress_type=$form.egress_type$&form.userid=$click.value2$&form.cdi_business.tok=$row.Business$]]>
          </link>
        </drilldown>

I've tried several examples. The best result of which just gives me an error of "invalid earliest_time".

I'd like the user to be able to pick a date range, click a drill down item from that date range, and have it carry over to the dashboard. I'd prefer not to include 'earliest=$token$' in the search string itself, and to use the global picker.

Thanks in advance.

dmitrynt
Engager

Hey Guys how do i perform same thing inside Dashboard Studio?

 

Thanks

0 Karma

AsmaF2025
Explorer

Did you get answer to this ?
Can u help with resolution you obtained?

0 Karma

sundareshr
Legend

You need to specify the name of the timepicker in the URL. Try this RA sample, see if this will work for your (it calls itself)

<form>
  <label></label>
  <fieldset submitButton="false">
    <input type="time" token="t">
      <label>Tiem</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | head 1</query>
          <earliest>$t.earliest$</earliest>
          <latest>$t.latest$</latest>
        </search>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown target="My New Window">
          <link>
            <![CDATA[http://localhost:8000/en-US/app/test/test_time_chart?form.t.earliest=$t.earliest$&form.t.latest=now]]>
          </link>
        </drilldown>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

somesoni2
Revered Legend

Can you share your full dashboard xml OR at least the full panel xml where this drilldown exists?

0 Karma

mcrawford44
Communicator
<panel>
  <table>
    <title>Top Users</title>
    <search>
      <query>foo | table userid Business</query>
    </search>
    <option name="count">10</option>
    <drilldown target="My New Window">
      <link field="user">
        <![CDATA[https://foo.com/en-US/app/appname/dashboardname?form.egress_type=$form.egress_type$&form.userid=$click.value2$&form.cdi_business.tok=$row.Business$]]>
      </link>
    </drilldown>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
  </table>
</panel>

I'm not sure how this is relevant considering the mechanism would be identical between all implementations. Documentation says to use earliest/latest as the tokens ; http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...

Like this;

<![CDATA[https://foo.com/en-US/app/appname/dashboardname?form.egress_type=$form.egress_type$&form.userid=$click.value2$&form.cdi_business.tok=$row.Business$&earliest=$earliest$&latest=$latest$]]>

However, that appears to do nothing at all.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...