Dashboards & Visualizations
Highlighted

How do I pass one dashboard date/time picker through drilldown to a second dashboard?

Communicator

I have the following drilldown configuration in a dashbaord;

        <drilldown target="My New Window">
          <link field="user">
            <![CDATA[https://foo.com/en-US/app/appname/dashboardname?form.egress_type=$form.egress_type$&form.userid=$click.value2$&form.cdi_business.tok=$row.Business$]]>
          </link>
        </drilldown>

I've tried several examples. The best result of which just gives me an error of "invalid earliest_time".

I'd like the user to be able to pick a date range, click a drill down item from that date range, and have it carry over to the dashboard. I'd prefer not to include 'earliest=$token$' in the search string itself, and to use the global picker.

Thanks in advance.

0 Karma
Highlighted

Re: How do I pass one dashboard date/time picker through drilldown to a second dashboard?

SplunkTrust
SplunkTrust

Can you share your full dashboard xml OR at least the full panel xml where this drilldown exists?

0 Karma
Highlighted

Re: How do I pass one dashboard date/time picker through drilldown to a second dashboard?

Communicator
<panel>
  <table>
    <title>Top Users</title>
    <search>
      <query>foo | table userid Business</query>
    </search>
    <option name="count">10</option>
    <drilldown target="My New Window">
      <link field="user">
        <![CDATA[https://foo.com/en-US/app/appname/dashboardname?form.egress_type=$form.egress_type$&form.userid=$click.value2$&form.cdi_business.tok=$row.Business$]]>
      </link>
    </drilldown>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
  </table>
</panel>

I'm not sure how this is relevant considering the mechanism would be identical between all implementations. Documentation says to use earliest/latest as the tokens ; http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/PanelreferenceforSimplifiedXML#Drilldown_event...

Like this;

<![CDATA[https://foo.com/en-US/app/appname/dashboardname?form.egress_type=$form.egress_type$&form.userid=$click.value2$&form.cdi_business.tok=$row.Business$&earliest=$earliest$&latest=$latest$]]>

However, that appears to do nothing at all.

0 Karma
Highlighted

Re: How do I pass one dashboard date/time picker through drilldown to a second dashboard?

Legend

You need to specify the name of the timepicker in the URL. Try this RA sample, see if this will work for your (it calls itself)

<form>
  <label></label>
  <fieldset submitButton="false">
    <input type="time" token="t">
      <label>Tiem</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | head 1</query>
          <earliest>$t.earliest$</earliest>
          <latest>$t.latest$</latest>
        </search>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">10</option>
        <drilldown target="My New Window">
          <link>
            <![CDATA[http://localhost:8000/en-US/app/test/test_time_chart?form.t.earliest=$t.earliest$&form.t.latest=now]]>
          </link>
        </drilldown>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.