Dashboards & Visualizations

How many tokens can I pass from one panel to another?

HattrickNZ
Motivator

How many tokens can I pass from one panel to another? Below is my thinking, but not sure if I am right?

panel 1 is a table with 3 values I want to pass to panel 2:

<drilldown>
<set token="mytoken">$click.name$</set>
<set token="mytoken2">$click.name2$</set>
<set token="mytoken3">$click.value$</set>
</drilldown>

This is panel 2 which receives these tokens:

<row>
<panel depends="$mytoken$" depends="$click.name2$" depends="$click.value$">
<chart>



....
</chart>
</panel>
</row>
Tags (3)
0 Karma

HattrickNZ
Motivator

think this is what i am looking for from here
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/tokens

 Token    Description
 click.name    Name of the leftmost field that appears in the table. This is always _time, if present.
 click.value    Value of the leftmost column in the row.
 click.name2    Name of the column.
 click.value2    Value of the column.
 row.    All field values for the table row, including those fields that are not displayed.
 earliest/latest    Time range of the table row, or if not applicable, the time range of the search.
0 Karma

exocore123
Path Finder

Could you expand on passing rows?

0 Karma

niketn
Legend

@exocore123, you can use Field Names for the columns which are displayed in the table. Following is a run anywhere search using Splunk's _internal index. For example for log_level I have used $row.log_level$.

PS: for _time which is the first column in my result, it can also be accessed by $click.name$, as stated in the document or with $row._time$ as well

  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level!="INFO"
| bin span=1h _time 
| stats count by _time log_level component</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="log_level">$row.log_level$</set>
          <set token="component">$row.component$</set>
          <set token="count">$row.count$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$log_level$,$component$,$count$">
      <title>$log_level$ $component$ $count$</title>
      <chart>
      </chart>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

I don't think so there is any documented limit on the drilldown tokens. You can setup the drilldown level at row level, if it's a table and then can use either $click.*$ tokens OR "$row.$ token that can be passed. See the drilldown section from below link to find possible tokens that can be set/passed.

http://docs.splunk.com/Documentation/Splunk/5.0/Viz/PanelreferenceforSimplifiedXML

0 Karma

HattrickNZ
Motivator

think this is what i am looking for from here
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/tokens

Token   Description
click.name  Name of the leftmost field that appears in the table. This is always _time, if present.
click.value Value of the leftmost column in the row.
click.name2 Name of the column.
click.value2    Value of the column.
row.<fieldname> All field values for the table row, including those fields that are not displayed.
earliest/latest Time range of the table row, or if not applicable, the time range of the search.
0 Karma
Get Updates on the Splunk Community!

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...