- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have two dashboards, both with some input fields, with one of them being common between both; a multiselect input field.
This multiselect input field has a token prefix and a suffix with the delimiter OR.
<label>Application</label> <choice value="app1">A</choice> <choice value="app2">B</choice> <valuePrefix>index=phase-</valuePrefix> <valueSuffix>-app</valueSuffix> <delimiter> OR </delimiter> </input>
and in the search query, I have
| tstats count as Total WHERE ($app$)
So in the original dashboard, the search is fine.
However, in drilldown, I have Link to another dashboard
form.app=$app$
and this causes problems as it passes "index=phase-A-app OR index=phase-B-app" in form.app and in the target dashboard, due to the same token suffix and prefix , the token changes to "index=phase-index=phase-A-app OR index=phase-B-app-app" which is wrong.
So, my question is, how do I deal with this to be able to send form.app=A form.app=B to the destination dashboard?
Thanks in advance,
Regards,
aahiri
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here's a sample dashboard....the change on the input formats the token the way you need it...then you use it in the drilldown. In this case, the token on the destination dashboards is "t_comp".
Let me know if something like this works for you.
<form>
<label>Eric_Test_10</label>
<fieldset submitButton="false">
<input type="multiselect" token="t_component">
<label>choose components</label>
<fieldForLabel>component</fieldForLabel>
<fieldForValue>component</fieldForValue>
<search>
<query>index=_internal sourcetype=splunkd | stats count by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>component="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<change>
<eval token="t_drilldown_tokens">"form.t_comp=" . replace(mvjoin($form.t_component$,","),",","&form.t_comp=")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<title>$t_drilldown_tokens$</title>
<table>
<title>$form.t_component$</title>
<search>
<query>index=_internal $t_component$
| stats count by component</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<link target="_blank">eric_test_20?$t_drilldown_tokens|n$</link>
</drilldown>
</table>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here's a sample dashboard....the change on the input formats the token the way you need it...then you use it in the drilldown. In this case, the token on the destination dashboards is "t_comp".
Let me know if something like this works for you.
<form>
<label>Eric_Test_10</label>
<fieldset submitButton="false">
<input type="multiselect" token="t_component">
<label>choose components</label>
<fieldForLabel>component</fieldForLabel>
<fieldForValue>component</fieldForValue>
<search>
<query>index=_internal sourcetype=splunkd | stats count by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>component="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<change>
<eval token="t_drilldown_tokens">"form.t_comp=" . replace(mvjoin($form.t_component$,","),",","&form.t_comp=")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<title>$t_drilldown_tokens$</title>
<table>
<title>$form.t_component$</title>
<search>
<query>index=_internal $t_component$
| stats count by component</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<link target="_blank">eric_test_20?$t_drilldown_tokens|n$</link>
</drilldown>
</table>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for this! For sure it's a step in the right direction.
However, for some reason it doesn't seem to work all the time.
Sometimes even when both options are selected, only one of the options (random option) is passed in the $t_drilldown_tokens|n$
edit: i figured out why. it's because I have a submit button 😐
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what if you pass the form token instead?
form.app=$form.app$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you! I tried this, and now I have
form.app=A,B
is there a way to manipulate this on the destination dashboard to make it two distinct values?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is it set up as an input on the destination too? If so, just give that input the same processing rules (prefix, suffix, delim, whatever) as in the source dashboard?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It has the same values.
The issue is that when drilling down, the URL contains "form.indices=(history%2Csummary)" instead of "form.indices=history&form.indices=summary"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hmm...ok. i'm at work currently but can maybe try to work on an example later tonight, if i can get it working
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @aahiri
Did you find any solution for this? I have the same issue..