How to create a drilldown selection to update form tokens on a dashboard?

[phoenixdigital]

So this example dashboard will work on any Splunk instance.

Myself and our other engineers can't seem to get the input at the top of the form to update?

The only solutions we can think of would be either custom javascript or have the page submit to itself with the fields passed in the URL.

Test dashboard below.

<form>
  <label>Drilldown Example Table Complex</label>
  <fieldset submitButton="false">
    <input type="text" token="component">
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd| stats count(eval(log_level="INFO")) as INFO  count(eval(log_level="ERROR")) as ERROR by component</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
        <drilldown>
          <condition field="component">
              <set token="component">$click.value$</set>
              <set token="log_level">*</set>
          </condition>
          <condition field="INFO">
              <set token="log_level">$click.name2$</set>
              <set token="component">$click.value$</set>
          </condition>
          <condition field="ERROR">
              <set token="log_level">$click.name2$</set>
              <set token="component">$click.value$</set>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Search = index=_internal component="$component$" log_level="$log_level$"</title>
        <search>
          <query>index=_internal component="$component$" log_level="$log_level$"</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

[niketn]

@phoenixdigital, set the default value of Text input to $component$ i.e. <default>$component$</default> and in the <init> section set component token to asterisk ( * ). Please try out and confirm.

PS: <init> section is available in version 6.5 and above. You would need a dummy search to set component to asterisk using search event handler in case you are on Splunk version 6.4 or previous.

<form>
  <label>Drilldown Example Table Complex</label>
  <init>
    <set token="component">*</set>
  </init>
  <fieldset submitButton="false">
    <input type="text" token="component">
      <default>$component$</default>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd| stats count(eval(log_level="INFO")) as INFO  count(eval(log_level="ERROR")) as ERROR by component</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <condition field="component">
            <set token="component">$click.value$</set>
            <set token="log_level">*</set>
          </condition>
          <condition field="INFO">
            <set token="log_level">$click.name2$</set>
            <set token="component">$click.value$</set>
          </condition>
          <condition field="ERROR">
            <set token="log_level">$click.name2$</set>
            <set token="component">$click.value$</set>
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Search = index=_internal component="$component$" log_level="$log_level$"</title>
        <search>
          <query>index=_internal component="$component$" log_level="$log_level$"</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

[michaeltokar]

I was having the same issue - the documentation did not make it clear how to do this for drill down's that altered the same dashboard as opposed to loading a new one in a new tab. There is a clue, however, in how it recommends to set form inputs on new dashboards:

<drilldown>
   <link>/app/foursquare_vegas/vegas_badge_1?form.badge=$click.value2$</link>
</drilldown>

Assuming that badge was the token name here, the recommendation is to use the URL parameter form.badge. If we do the same with our <drilldown> element, it will have the effect of updating the input at the top of the dashboard.

<drilldown>
 <condition field="component">
     <set token="component">$click.value$</set>
     <set token="form.component">$click.value$</set>
     <set token="log_level">*</set>
 </condition>
 <condition field="INFO">
     <set token="log_level">$click.name2$</set>
     <set token="component">$click.value$</set>
     <set token="form.component">$click.value$</set>
 </condition>
 <condition field="ERROR">
     <set token="log_level">$click.name2$</set>
     <set token="component">$click.value$</set>
     <set token="form.component">$click.value$</set>
 </condition>
</drilldown>

[sbrice18]

Drilldown Example Table Complex

<input type="text" token="component" searchWhenChanged="true">
  <label>component</label>
  <default>*</default>
</input>
<input type="text" token="log_level" searchWhenChanged="false">
  <label>log_level</label>
  <default>*</default>
</input>
<input type="time" token="field1">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <table>
    <search>
      <query>index=_internal sourcetype=splunkd| stats count(eval(log_level="INFO")) as INFO  count(eval(log_level="ERROR")) as ERROR by component</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="rowNumbers">false</option>
    <option name="wrap">true</option>
    <drilldown>
      <condition field="component">
        <set token="component">$click.value$</set>
        <set token="log_level">*</set>
      </condition>
      <condition field="INFO">
        <set token="log_level">$click.name2$</set>
        <set token="component">$click.value$</set>
      </condition>
      <condition field="ERROR">
        <set token="log_level">$click.name2$</set>
        <set token="component">$click.value$</set>
      </condition>
    </drilldown>
  </table>
</panel>


<panel>
  <event>
    <title>$component$  $log_level$</title>
    <search>
      <query>index="_internal" sourcetype=splunkd component="$component$" log_level="$log_level$"</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <option name="list.drilldown">none</option>
    <option name="raw.drilldown">none</option>
    <option name="table.drilldown">none</option>
    <option name="type">list</option>
  </event>
</panel>

[michaeltokar]

How does this address the problem, which is that the input field on the dashboard form does not update with the selected drill down value?

[phoenixdigital]

It doesn't address it . This was still part of the original question just showing a more complex form.

I'm still waiting on a response 2.5 years on 🙂