How to control drilldown on dashboard chart click?

[clairebesson]

Hey everyone,
I have a graph as shown in the figure below :

Server1 and Server2 are two different sources.
For now I did this drilldown :
<drilldown target="_What - Track Up Aps">

      <condition field="Up">
        <link>
      /app/search/what__track_up_aps?form.Up=$click.value$
    </link>
      </condition>
      <condition field="Down">
   <link>
      /app/search/what__track_down_aps?form.Down=$click.value$
    </link>
      </condition>


  </drilldown>

When you click on Up you go on the dashboard at the address : /app/search/what__track_up_aps?

And when you click on Down you go on the dashboard at the address :
/app/search/what__track_down_aps?

However, I want to do that:
- When I click on Up from Server1 I go on dashboard1
- When I click on Up from Server2 I go on dashboard2

• When I click on Down from Server1 I go on dashboard3
• When I click on Down from Server2 I go on dashboard4

I don’t know how to put a condition on “Server1” or “Server2”
Could you please help me with that ?
Thanks in advance

[martin_mueller]

This should get you started: http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/FormEditor

[martin_mueller]

Your top produces three fields, Type count percent. Yet, you're telling the input to look for labels and values in the source field... which does not exist in your top results.

[clairebesson]

thanks. So I tried to add a dropdown on which I can choose to display server 1 or server 2.
I looked at the example on app Splunk 6x Dashboard Examples. There is a dropdown with different sourcetype.
I did the same but it didn't work. In my case the dropdown permit to choose between different sources (server1.csv and server2.csv)

<input type="dropdown" token="source" searchWhenChanged="true">
  <label>Select a source:</label>
  <prefix>source="</prefix>
  <suffix>"</suffix>
  <choice value="*">All</choice>
  <search>
    <query>source=airwave* Status=Down| top limit=20 Type</query>
  </search>
  <fieldForLabel>source</fieldForLabel>
  <fieldForValue>source</fieldForValue>
</input>

[martin_mueller]

Yeah, add form fields at the top to select the server and pre-populate this with the value from the drilldown.

[clairebesson]

sorry I am a newbie in Splunk. I do not know at all how to do that.
could you please help me with that ?

[martin_mueller]

Are you sure you want different dashboards for each server instead of passing the server name as a parameter to the same dashboard?

[clairebesson]

you mean to have one dashboard for the Up. On that dashboard I create a menu in order to choose which server I want to display ?