Dashboards & Visualizations

How do I pass the current form values to a drilldown link

chapa
Explorer

I have a dataset that has multiple attributes:
accountNumber, deviceNumber, eventName, status

I built a dashboard with 4 panels each showing "chart count by x" for each of the 4 attributes.

I want to allow to user to click on a value in the panel to filter the dashboard on that value, but I also want them to compound. So in order to do so, I have to pass, not only the click.value, but also each of the form's current values like this:

<drilldown>
  <link>
    <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$form.deviceNumber$&form.eventName=$form.eventName$&form.status=$form.status$&form.timePicker.earliest=$form.timePicker.earliest$&form.timePicker.latest=$form.timePicker.latest$&earliest=0&latest=]]>
  </link>
</drilldown>

which is kind of a pain.

Is there a way to send a single form.values or token that would pass all the form's current values so I can shorten the link to this:

 <drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.allValues=$form.allValues$]]>
   </link>
 </drilldown>
0 Karma

jkat54
SplunkTrust
SplunkTrust

There is a way but it's not pretty.

You could eval mvzip them all together in search strings or otherwise create a multi value field with all the drop down values. Then put that field in a table for the user to click. Then when they clicked, the multi valued token would go through the drill down and you could use eval mvindex to extract the individual tokens back out.

You might also be interested in this:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

There's a subsection on using mv fields in drill downs.

0 Karma

somesoni2
Revered Legend

AFAIK, there is no such option in simple xml. Although, you can remove some $form. prefix for local tokens, making little better

<drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$deviceNumber$&form.eventName=$eventName$&form.status=$status$&form.timePicker.earliest=$timePicker.earliest$&form.timePicker.latest=$timePicker.latest$]]>
   </link>
 </drilldown>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...