How to connect drilldown and multiselect/dropdown in dashboard studio?

[Iwert]

Hi all

I have a dashboard made with Dashboard Studio with multiple tables and graphs.
For it to be more interactive I would like to be able to click in my visualizations and update a token that is shared across the dashboard.

I have created a dynamically populated multiselect and drilldowns in my visualizations. The drilldown recognizes the token of the multiselect. When i click, the visualizations update for a second and then reset. The token seems to update and gets immediately reset by the multiselect field which does not update.
Similar behaviour occurs for the dropdown input.

Does anyone know why it happens and how to fix it?

[ITWhisperer]

Which version of splunk are you using?

Please can you share the source of your dashboard?

[Iwert]

I am using Splunk cloud version 9.0.2208.1

The source for the multiselect button:

"input_dhtiWnl4": {
			"options": {
				"items": ">frame(label, value) | prepend(formattedStatics) | objects()",
				"token": "Task_Name_Filter",
				"defaultValue": [
					"*"
				]
			},
			"title": "Daily Task Name Selection",
			"type": "input.multiselect",
			"dataSources": {
				"primary": "ds_tapmtJKf"
			},
			"context": {
				"formattedConfig": {
					"number": {
						"prefix": ""
					}
				},
				"formattedStatics": ">statics | formatByType(formattedConfig)",
				"statics": [
					[
						"All Tasks"
					],
					[
						"*"
					]
				],
				"label": ">primary | seriesByName(\"ShortName\") | renameSeries(\"label\") | formatByType(formattedConfig)",
				"value": ">primary | seriesByName(\"Win_Task_Name\") | renameSeries(\"value\") | formatByType(formattedConfig)"
			}
		},

The datasource for this input:

"ds_tapmtJKf": {
			"type": "ds.search",
			"options": {
				"query": "index=PRO-WINTSK-* Win_Task_Name=\"\\\\PRD*\" NOT Win_Task_Name IN (\"\\\\PRD\\\\Xofin.Schedule.Invoicing.Run\", \"\\\\PRD\\\\Xofin.Schedule.Admin.SendDocuments2\", \"\\\\PRD\\\\Xofin.Schedule.Planning.AutoPlanningMed\", \"\\\\PRD\\\\Xofin.Schedule.Planning.SendConvocation\", \"\\\\PRD\\\\Xofin.Schedule.Seed.CreateMedicalFile\", \"\\\\PRD\\\\Xofin.Schedule.Admin.Efficient51\", \"\\\\PRD\\\\Xofin.Schedule.UploadToVaccinet*\")\n    | transaction InstanceId \n    | stats latest_time(duration) as LastRun by Win_Task_Name \n| eval ShortName=replace(Win_Task_Name, \"\\\\\\PRD\\\\\\Xofin\\\\.Schedule\\\\.\",\"\")\n    | sort LastRun desc\n    | fields Win_Task_Name ShortName",
				"queryParameters": {
					"earliest": "$global_time.earliest$",
					"latest": "$global_time.latest$"
				}
			},
			"name": "TaskNames"
		}

And the code for a table:
How should i go a about setting the drilldown when i rename the column i want the value from to something with a space as shown below?

		"viz_table_1": {
			"type": "splunk.table",
			"options": {
				"count": 25,
				"dataOverlayMode": "none",
				"drilldown": "none",
				"percentagesRow": false,
				"rowNumbers": false,
				"totalsRow": false,
				"wrap": true,
				"headerVisibility": "fixed",
				"columnFormat": {
					"Average Run Tim (s)": {
						"data": "> table | seriesByName(\"Average Run Tim (s)\") | formatByType(Average_Run_Tim__s_ColumnFormatEditorConfig)",
						"width": 180.58333333333334
					},
					"Latest Run Time (s)": {
						"data": "> table | seriesByName(\"Latest Run Time (s)\") | formatByType(Latest_Run_Time__s_ColumnFormatEditorConfig)"
					},
					"Deviation in %": {
						"data": "> table | seriesByName(\"Deviation in %\") | formatByType(Deviation_in__ColumnFormatEditorConfig)",
						"rowColors": "> table | seriesByName(\"Deviation in %\") | rangeValue(Deviation_in__RowColorsEditorConfig)"
					},
					"Win_Task_Name": {
						"width": 436
					},
					"Trend of Run Time": {
						"width": 486.66666666666663
					},
					"# of Runs": {
						"width": 116.77777777777777
					},
					"Latest Start Time": {
						"width": 184.16666666666669
					}
				}
			},
			"dataSources": {
				"primary": "ds_search_1"
			},
			"title": "Task Run Times",
			"context": {
				"Average_Run_Tim__s_ColumnFormatEditorConfig": {
					"number": {
						"thousandSeparated": false,
						"unitPosition": "after",
						"precision": 2,
						"unit": "s"
					}
				},
				"Latest_Run_Time__s_ColumnFormatEditorConfig": {
					"number": {
						"thousandSeparated": false,
						"unitPosition": "after",
						"unit": "s",
						"precision": 2
					}
				},
				"Deviation_in__ColumnFormatEditorConfig": {
					"number": {
						"thousandSeparated": false,
						"unitPosition": "after",
						"unit": "%",
						"precision": 2
					}
				},
				"Deviation_in__RowColorsEditorConfig": [
					{
						"value": "#da3b30",
						"to": -80
					},
					{
						"value": "#a0312e",
						"from": -80,
						"to": -40
					},
					{
						"value": "#252214",
						"from": -40,
						"to": 0
					},
					{
						"value": "#252214",
						"from": 0,
						"to": 40
					},
					{
						"value": "#a0312e",
						"from": 40,
						"to": 80
					},
					{
						"value": "#DA3B30",
						"from": 80
					}
				]
			},
			"description": "Overview of all daily Windows Jobs",
			"eventHandlers": [
				{
					"type": "drilldown.setToken",
					"options": {
						"tokens": [
							{
								"token": "Task_Name_Filter",
								"key": "row.Win_Task_Name.value"
							}
						]
					}
				}
			]
		},

 Datasource for this table:

		"ds_search_1": {
			"type": "ds.search",
			"options": {
				"query": "index=$Env$-WINTSK-* Win_Task_Name=\"\\\\PRD*\" NOT Win_Task_Name IN (\"\\\\PRD\\\\Xofin.Schedule.Invoicing.Run\", \"\\\\PRD\\\\Xofin.Schedule.Admin.SendDocuments2\", \"\\\\PRD\\\\Xofin.Schedule.Planning.AutoPlanningMed\", \"\\\\PRD\\\\Xofin.Schedule.Planning.SendConvocation\", \"\\\\PRD\\\\Xofin.Schedule.Seed.CreateMedicalFile\", \"\\\\PRD\\\\Xofin.Schedule.Admin.Efficient51\", \"\\\\PRD\\\\Xofin.Schedule.UploadToVaccinet*\") Win_Task_Name IN ($Task_Name_Filter|s$)\n| transaction InstanceId \n| stats avg(duration) as AvgDur sparkline(avg(duration)) as DurTrend count as Runs latest_time(duration) as LastRun latest(duration) as LastRunTime by Win_Task_Name\n| eval LastRun=strftime(LastRun, \"%d %B %Y %H:%M\")| eval Devi=((LastRunTime - AvgDur)/AvgDur)*100  \n\n| eval LastRunTime=tostring(LastRunTime, \"duration\")\n| eval AvgDur=tostring(round(AvgDur, 2), \"duration\")\n| sort Devi desc  | rename  Devi as \"Deviation in %\", LastRun as \"Latest Start Time\" LastRunTime as \"Latest Run Time (s)\", AvgDur as \"Average Run Tim (s)\", Runs as \"# of Runs\", DurTrend as \"Trend of Run Time\", Win_Task_Name as \"Task Name\"",
				"queryParameters": {
					"earliest": "$global_time.earliest$",
					"latest": "$global_time.latest$"
				}
			},
			"name": "TaskRunTimes"
		},

Chart using the same token and a drilldown:

"viz_chart_1": {
			"type": "splunk.line",
			"dataSources": {
				"primary": "ds_search_1_new"
			},
			"title": "Most recent Tasks",
			"options": {
				"yAxisAbbreviation": "auto",
				"y2AxisAbbreviation": "auto",
				"showRoundedY2AxisLabels": false,
				"legendTruncation": "ellipsisStart",
				"showY2MajorGridLines": true,
				"xAxisLabelRotation": 0,
				"xAxisTitleText": "Time",
				"xAxisTitleVisibility": "show",
				"yAxisTitleVisibility": "show",
				"y2AxisTitleVisibility": "show",
				"yAxisScale": "linear",
				"showOverlayY2Axis": 0,
				"y2AxisScale": "inherit",
				"dataValuesDisplay": "all",
				"showSplitSeries": 0,
				"showIndependentYRanges": 0,
				"legendMode": "standard",
				"lineWidth": 2,
				"nullValueDisplay": "connect",
				"yAxisTitleText": "Duration (s)"
			},
			"description": "Duration of the most recent tasks",
			"eventHandlers": [
				{
					"type": "drilldown.setToken",
					"options": {
						"tokens": [
							{
								"token": "Task_Name_Filter",
								"key": "name"
							}
						]
					}
				}
			]
		},

Datasource for this chart:

		"ds_search_1_new": {
			"type": "ds.search",
			"options": {
				"query": "index=$Env$-WINTSK-* \n    [ search index=$Env$-WINTSK-* Win_Task_Name=\"\\\\PRD*\" NOT Win_Task_Name IN (\"\\\\PRD\\\\Xofin.Schedule.Invoicing.Run\", \"\\\\PRD\\\\Xofin.Schedule.Admin.SendDocuments2\", \"\\\\PRD\\\\Xofin.Schedule.Planning.AutoPlanningMed\", \"\\\\PRD\\\\Xofin.Schedule.Planning.SendConvocation\", \"\\\\PRD\\\\Xofin.Schedule.Seed.CreateMedicalFile\", \"\\\\PRD\\\\Xofin.Schedule.Admin.Efficient51\", \"\\\\PRD\\\\Xofin.Schedule.UploadToVaccinet*\") Win_Task_Name IN ($Task_Name_Filter|s$) \n    | transaction InstanceId \n    | stats latest_time(duration) as LastRun by Win_Task_Name \n    | sort 5 LastRun desc\n    | fields Win_Task_Name]\n| transaction InstanceId\n| timechart span=1d avg(duration) by Win_Task_Name useother=f",
				"queryParameters": {
					"earliest": "$global_time.earliest$",
					"latest": "$global_time.latest$"
				}
			},
			"name": "RecentTaskGraph"
		},

[bTonyC]

Hello, I am seeing exactly the same behaviour that you have described.

When I click on the visualization, the URL in the address bar changes (I can see the parameter change to the correct value) but it immediately changes back to what it was (default?)
The content of the dashboard does not even attempt to update.

Using the Multiselect works fine. Changes the chart visualisation.

Can we use the same token for the multiselect as we use in the chart drilldown?? That is what I want to do.

Thanks