Dashboards & Visualizations

How to pass static text or value to a drilldown?

ahogbin
Communicator

Hello,

I am trying to pass a static value to another form but not having much luck

<drilldown target="My New Window">
          <link>
            <![CDATA[quotes_by_broker?form.token_range=$totalQuotes>=1 AND totalQuotes<=20$&earliest=$earliest$&latest=$latest$
       ]]>
          </link>
        </drilldown>

The drilldown is called when a user clicks on a value and should load a form (which it does) and populate the token_range field which in turn is then used in a search. The reason I am trying to pass a static value is that source dashboard displays results as a single value and I would like to then display the breakdown to the user in the linked dashboard.

The problem I have is that the new dashboard / form loads but the value populated into the token_range field is $totalQuotes> and nothing else.

I have tried adding $$ to the value but no joy.

Open to suggestions and any help is greatly appreciated.

Cheers,

Alastair

0 Karma
1 Solution

lguinn2
Legend

I don't think you can have spaces in a link. Plus, I don't know why you put all of the $ in there...
I would try

<![CDATA[quotes_by_broker?form.token_range="totalQuotes>=1 AND totalQuotes<=20"&earliest=$earliest$&latest=$latest$
        ]]>

But you may have to actually encode it by replacing spaces with %20.

View solution in original post

0 Karma

lguinn2
Legend

I don't think you can have spaces in a link. Plus, I don't know why you put all of the $ in there...
I would try

<![CDATA[quotes_by_broker?form.token_range="totalQuotes>=1 AND totalQuotes<=20"&earliest=$earliest$&latest=$latest$
        ]]>

But you may have to actually encode it by replacing spaces with %20.

0 Karma

ahogbin
Communicator

Hello,

Thanks for the above but I have narrowed to the issue down to the '=' sign. For some reason this is getting stripped when the text is being passed across. If I remove the '=' sign then all works but the search returns the incorrect results.

Is there a way of stopping the sign from being removed ?

Cheers.

0 Karma

ahogbin
Communicator

Found it .... adding %3D fixes the issue.

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...