Dashboards & Visualizations

How do I pass the current form values to a drilldown link

chapa
Explorer

I have a dataset that has multiple attributes:
accountNumber, deviceNumber, eventName, status

I built a dashboard with 4 panels each showing "chart count by x" for each of the 4 attributes.

I want to allow to user to click on a value in the panel to filter the dashboard on that value, but I also want them to compound. So in order to do so, I have to pass, not only the click.value, but also each of the form's current values like this:

<drilldown>
  <link>
    <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$form.deviceNumber$&form.eventName=$form.eventName$&form.status=$form.status$&form.timePicker.earliest=$form.timePicker.earliest$&form.timePicker.latest=$form.timePicker.latest$&earliest=0&latest=]]>
  </link>
</drilldown>

which is kind of a pain.

Is there a way to send a single form.values or token that would pass all the form's current values so I can shorten the link to this:

 <drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.allValues=$form.allValues$]]>
   </link>
 </drilldown>
0 Karma

jkat54
SplunkTrust
SplunkTrust

There is a way but it's not pretty.

You could eval mvzip them all together in search strings or otherwise create a multi value field with all the drop down values. Then put that field in a table for the user to click. Then when they clicked, the multi valued token would go through the drill down and you could use eval mvindex to extract the individual tokens back out.

You might also be interested in this:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Dynamicdrilldownindashboardsandforms

There's a subsection on using mv fields in drill downs.

0 Karma

somesoni2
Revered Legend

AFAIK, there is no such option in simple xml. Although, you can remove some $form. prefix for local tokens, making little better

<drilldown>
   <link>
     <![CDATA[myDashboard?form.accountNumber=$click.value$&form.deviceNumber=$deviceNumber$&form.eventName=$eventName$&form.status=$status$&form.timePicker.earliest=$timePicker.earliest$&form.timePicker.latest=$timePicker.latest$]]>
   </link>
 </drilldown>
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...