Dashboards & Visualizations

How to achieve drilldown from Dashboard Studio with results field value passed to it as token?

harshal_chakran
Builder

Hi Everyone,

Need one help,
I am trying to drilldown from a single value box developed in Dashboard Studio to another simple xml dashboard with values passed down as a token.

But here is a complex part.
The search populating the single value at Dashboard Studio provides two fields as a result : 
1) count_id
2) list_of_id

I want to show 'count_id' on Single Value and allow drilldown to pass "list_of_id".
I have tried $row.list_of_id$ & also $row.list_of_id.value$

Labels (4)
0 Karma

danspav
SplunkTrust
SplunkTrust

Hi @harshal_chakran,

You can set up the tokens in Dashboard Studio from the search results for the Single Value viz - see the docs article on Setting tokens from search results.

When you create your search, check the "Use search results or job status as tokens" checkbox:

danspav_0-1687848544441.png


Now once the search runs, you can use a token like this:

$search name:result.<field>$

In our case it would be: $Single_Value_Search:result.list_of_id$

Now in your single value drill-down you can link to the Simple XML dashboard using the token:

danspav_1-1687848840464.png


This will link to the Simple XML dashboard with the list_of_id token being set.


Cheers,

Daniel

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...