Dashboards & Visualizations

How to token transfer from one dashboard to another?

Contributor

I have two dashboards. Dashboard A and Dashboard B.

I have a table with filed name SERVER in Dashboard A. I want o pass on SERVER value from Dashboard A into the SERVER value text box in Dashboard B.

This is for drill down from A to B. I have drill down as "Link to Dashboard". When SERVER value is clicked in Dashboard A, it should take me to Dashboard B with "clicked" SERVER inserted into SERVER value text box in Dashboard B.

How do I do this?

Thanks

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@mbasharat Splunk Dashboard Examples App has an example for this particular scenario of passing Token from Source Dashboard to Destination as Form Token. Please download and try out the example.

Following is the kind of code you would need:

    <drilldown>
      <link target="_blank">/app/<yourSplunkAppName>/<yourDestinationDashboardName>?form.<yourTextBoxTokenNameInDestinationDashboard>=$row.SERVER$</link>
    </drilldown>

alt text

Following is a run anywhere example for source and destination dashboard based on Splunk's _internal index created under default search app (you would need to keep dashboard name as per the example to try them out)

Source Dashboard (sourcedashboardtopasscomponent.xml)

<dashboard>
  <label>Source Dashboard To Pass Component</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| top 5 component showperc=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">/app/search/destination_dashboard_to_use_component?form.tokComponent=$row.component$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Destination Dashboard (destinationdashboardtousecomponent.xml)

<form>
  <label>Destination Dashboard to Use Component</label>
  <fieldset submitButton="false">
    <input type="text" token="tokComponent" searchWhenChanged="true">
      <label>Filter Component</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO component="$tokComponent$"
| timechart count by component useother=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@mbasharat Splunk Dashboard Examples App has an example for this particular scenario of passing Token from Source Dashboard to Destination as Form Token. Please download and try out the example.

Following is the kind of code you would need:

    <drilldown>
      <link target="_blank">/app/<yourSplunkAppName>/<yourDestinationDashboardName>?form.<yourTextBoxTokenNameInDestinationDashboard>=$row.SERVER$</link>
    </drilldown>

alt text

Following is a run anywhere example for source and destination dashboard based on Splunk's _internal index created under default search app (you would need to keep dashboard name as per the example to try them out)

Source Dashboard (sourcedashboardtopasscomponent.xml)

<dashboard>
  <label>Source Dashboard To Pass Component</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| top 5 component showperc=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">/app/search/destination_dashboard_to_use_component?form.tokComponent=$row.component$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Destination Dashboard (destinationdashboardtousecomponent.xml)

<form>
  <label>Destination Dashboard to Use Component</label>
  <fieldset submitButton="false">
    <input type="text" token="tokComponent" searchWhenChanged="true">
      <label>Filter Component</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO component="$tokComponent$"
| timechart count by component useother=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Contributor

Great. This is exactly what I needed. THANK YOU!!

0 Karma

SplunkTrust
SplunkTrust

This is a very basic Splunk simple xml drilldown use-case. See this for how to implement it

http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/DrilldownLinkToDashboard#Example_source_code