Dashboards & Visualizations

How do I pass the current form values to a drilldown link

chapa
Explorer

I have a dataset that has multiple attributes:
accountNumber, deviceNumber, eventName, status

I built a dashboard with 4 panels each showing "chart count by x" for each of the 4 attributes.

I want to allow to user to click on a value in the panel to filter the dashboard on that value, but I also want them to compound. So in order to do so, I have to pass, not only the click.value, but also each of the form's current values like this:

<drilldown>
  <link>
    <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$form.deviceNumber$&form.eventName=$form.eventName$&form.status=$form.status$&form.timePicker.earliest=$form.timePicker.earliest$&form.timePicker.latest=$form.timePicker.latest$&earliest=0&latest=]]>
  </link>
</drilldown>

which is kind of a pain.

Is there a way to send a single form.values or token that would pass all the form's current values so I can shorten the link to this:

 <drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.allValues=$form.allValues$]]>
   </link>
 </drilldown>
0 Karma

jkat54
SplunkTrust
SplunkTrust

There is a way but it's not pretty.

You could eval mvzip them all together in search strings or otherwise create a multi value field with all the drop down values. Then put that field in a table for the user to click. Then when they clicked, the multi valued token would go through the drill down and you could use eval mvindex to extract the individual tokens back out.

You might also be interested in this:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

There's a subsection on using mv fields in drill downs.

0 Karma

somesoni2
Revered Legend

AFAIK, there is no such option in simple xml. Although, you can remove some $form. prefix for local tokens, making little better

<drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$deviceNumber$&form.eventName=$eventName$&form.status=$status$&form.timePicker.earliest=$timePicker.earliest$&form.timePicker.latest=$timePicker.latest$]]>
   </link>
 </drilldown>
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...