Dashboards & Visualizations

How to pass global time setting to different dashboard on trigger action?

elend
Path Finder

So the premise is that I constructed two dashboards: dashboard A as an overview and dashboard B as details. Then, on dashboard A, I configured one of the displays to have an on-click trigger that connects to dashboard B. However, the global time condition on dashboard A cannot be connected to dashboard B.

 

is it possible to make the time dynamic on dashboard B?

Labels (5)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @elend ,

there's no utility to pass a token to a report because a report is useful if there are no parameters.

If you have parameters (tokens) you can use a dashboard as a report, so you can pass the token from a dashboard to another dashboard, as also described by @bowesmana .

Ciao.

giuseppe

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

If you are passing tokens from dashboard A to dashboard B that are inputs in dashboard B, then use

&form.token_name=bla

where token_name is the name of your token in dashboard B

.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @elend ,

if the Time in dashboardA is defined in a Time imput called e.g. "Time", so the tokens are a called $Time.earliest$ and $Time.latest$, you can pass then in the drilldown url:

earliest=$Time.earliest$&latest=$Time.latest$

Ciao.

Giuseppe

0 Karma

elend
Path Finder

Okay, i thinks its done for it. Then another issue i want to ask is still relate with this tokenization, is it possible to pass token from dashboard to Report?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@elend 

You can pass tokens to a report by running the report using the savedsearch command and passing the values to the report - this assumes the report is set to have replaceable parameters, see the comments about replacement in this page.

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/savedsearch

so you would run this in your dashboard to run the report

| savedsearch report_name value=$token|s$

where $token$ is token you are passing to the report and it is assigned to the replaceable parameter $value$ in your report

gcusello
SplunkTrust
SplunkTrust

Hi @elend ,

there's no utility to pass a token to a report because a report is useful if there are no parameters.

If you have parameters (tokens) you can use a dashboard as a report, so you can pass the token from a dashboard to another dashboard, as also described by @bowesmana .

Ciao.

giuseppe

elend
Path Finder

how about set the time value on the linked dashboard?. If i delete the time range on linked dashboard (B), the visualization is wait for token. But if i add time range there, the global time from the destination dashboard is overwrite it.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @elend ,

you can add the Time tokens that you passed to the earliest and latest fields:

in the secondary dashboard, if the Time tokens are called $earliest$ and $latest$:

index=your_index earliest=$earliest$ latest=$latest$
| ...

 Ciao.

Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...