Dashboards & Visualizations

How do you manipulate a token before passing it to a drilldown?

splunkrocks2014
Communicator

How do you manipulate a token before passing it to a drilldown?

For example, the following dashboard has a a statistic table with a field, country with value "United States of America (USA)", and I just want to pass "USA" to the drilldown. But the token ("country") is not changed to "USA" from the eval function when passed to the deep link. Any clues? Thanks.

<dashboard>
  <label>testing</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval Country="United States of America (USA)"
| table Country</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <eval token="country">replace(replace(mvindex(split($click.value$," "),-1,-1),"\(",""),"\)","")</eval>
          <link target="_blank">
            <![CDATA[https://en.wikipedia.org/wiki/$country$]]>
          </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
1 Solution

renjith_nair
Legend

@splunkrocks2014 ,

It's possible to change but why don't you extract in the search itself? For e.g.

<dashboard>
  <label>testing</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval Country="United States of America (USA)"
| rex field="Country" "\((?<_C>.*)\)"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">
            <![CDATA[https://en.wikipedia.org/wiki/$row._C$]]>
          </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@splunkrocks2014 ,

It's possible to change but why don't you extract in the search itself? For e.g.

<dashboard>
  <label>testing</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval Country="United States of America (USA)"
| rex field="Country" "\((?<_C>.*)\)"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">
            <![CDATA[https://en.wikipedia.org/wiki/$row._C$]]>
          </link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
---
What goes around comes around. If it helps, hit it with Karma 🙂

splunkrocks2014
Communicator

Never thought about this way 🙂 ... thanks.

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...