How to create tokens dynamically

[poojak2579]

I want to pass tokens to the drilldown dashboard depending upon the panel that user selects.

Current Code

  <title>Changes by User</title>
  <chart>
    <search>
      <query>index=a |chart count over Asset by user usenull=false</query>
      <earliest>-90d</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
      <link>
        <![CDATA[/app/search/b_clone?form.Asset=$click.value$&form.user=$click.name2$]]>
      </link>
    </drilldown>
    </chart>
</panel>


<panel>
  <title>Changes by Severity</title>
  <chart>
    <search>
      <query>index=a|chart count over Asset by SeverityName</query>
      <earliest>-90d</earliest>
      <latest>now</latest>
    </search>

      <link>
        <![CDATA[/app/search/b_clone?form.Asset=$click.value$&form.SeverityName=$click.name2$]]>
      </link>
    </drilldown>
    </chart>
</panel>


<panel>
  <title>Changes by Type</title>
  <chart>
    <search>
      <query>index=a|chart count over asset by changetype usenull=false</query>
      <earliest>-90d</earliest>
      <latest>now</latest>
    </search>
    <drilldown>
        <link>
        <![CDATA[/app/search/b_clone?&form.Asset=$click.value$&form.ChangeType=$click.name2$]]>
      </link>

    </drilldown>

I can create a drilldown with static textboxes containing tokens of severityname, changetype and user but I want to create tokens depending upon the panel that user clicks.
If the user clicks on the secondchart, the drilldown should have a textbox of severity name and asset only whereas if he clicks on the secondchart, the drilldown should have user and asset tokens only.
Can we add a condition which creates token depending upon what panel is clicked?
My second question is if can we use tokens in the drilldown without creating input text boxes?

[niketn]

@poojak2579, can you please give some sample tabular data for three panels. Also let us know as to what is the drilldown values (sample data) you want to pass on from the chart?

You dont need to set a separate token for the three panels, since your underlying searches have same row field (i.e. asset) and different column fields (i.e. user, SeverityName and changetype respectively). You are accessing these field names through default tokens for drilldown that have generic names i.e. $click.value$ and $click.name2$.

Your existing dashboard should work without Text box. What is the value you are trying to pass on to text box and then use?

[poojak2579]

Thanks for the reply.
Here is the sample tabular data for the three panels:
Changes by User

Asset Root User1 User2
A1 100 5 2
A2 20 4 6
A3 50 0 8

        Changes by Severity

Asset Severity1 Severity2
A1 200 100
A2 100 50

A3 300 100

           Changes by ChangeType

Asset Added Modified
A1 150 150
A2 50 100

A3 200 200

I am passing three tokens Severity,User and ChangeType to the textboxes in the drilldown.
Drilldown is a single panel dashboard that will show the same details based on what user clicks.

Here is sample Drilldown Data:
When first panel is clicked and user info is passed :
Asset Severity ChangeType User

A1 Severity1 Modified User1

A1 Severity2 Added User1

Drilldown when the chart in the second panel is clicked and severity is passed to the drilldown
Asset Severity ChangeType User

A1 Severity1 Modified Root

A1 Severity1 Added

A3 Severity1 Modified User1

---

As we can see in the sample data there are some records that dont have user name.
We want to display all the records irrespective of user name when second panel is clicked and severity is passed but want to display records associated with a user when first panel is clicked and user is passed .

Please let me know how I can work without creating textbox in the drilldown.

[niketn]

So based on your existing code this drilldown is a separate Dashboard with a text box which forms the query based on input values for Asset and User or Severity or Change Type based on which panel gets clicked. If not please add the code for Text box so that we can know what it does.

Can you add the final query of the table? Do you happen to have separate query for each table in the new dashboard or single one to take care of all scenarios?

[poojak2579]

Thanks for the reply.
Yes, there is separate dashboard for drilldown.
Earlier I was considering single query for all the scenarios but now to resolve this issue,I have created separate queries for each panel and have made Input element and Panel to depend upon the token.

[mayurr98 · Accepted solution]

you need to depend your token on that panel
Try this link to depend on input filter
https://docs.splunk.com/Documentation/Splunk/6.6.3/Viz/tokens
Also refer

https://answers.splunk.com/answers/188709/how-to-display-dashboard-panels-dynamically.html

Let me know if it works

[poojak2579]

Thank you very much!
It does work by making the panels and input element depend on the token.
I didnt notice that we can hide input components also.
I added "depends" attribute to the following elements:

[mayurr98]

You are welcome 🙂

[skoelpin]

Yes, you have to set your tokens. The case below can be used with a drop down and hide panels based off user input

<choice value="skoelpin">Option</choice>
<change>
<condition value="skoelpin">
<set token="panel1">true</set>
<unset token="panel2"></unset>
</condition>
<choice value="*">All</choice>
<set token="panel2">true</set>
<unset token="panel1"></unset>
</condition>
</change>

You then need to go to each panel and add depends="$panel1$" and depends="$panel2$"

[poojak2579]

Thanks for the reply
There is a single panel in the drilldown dashboard that will show the details based on the input.
First Chart in the main dashboard passes user name and asset name whereas second chart passes severity name and asset name to the drill down dashboard
There are certain records that does not have user name but if we hide it, results will not come until it gets the input for user type.
When second chart is clicked there will be no input for user name ,but we want to show all the records irrespective of user name. I tried by adding this statement also:

|eval a = if(isnull(user),"*",user)
|where user=a

It does not work when user=* as * does not work with where clause.
Please suggest if there is any other way to do this.