How to token transfer from one dashboard to another?

[mbasharat]

I have two dashboards. Dashboard A and Dashboard B.

I have a table with filed name SERVER in Dashboard A. I want o pass on SERVER value from Dashboard A into the SERVER value text box in Dashboard B.

This is for drill down from A to B. I have drill down as "Link to Dashboard". When SERVER value is clicked in Dashboard A, it should take me to Dashboard B with "clicked" SERVER inserted into SERVER value text box in Dashboard B.

How do I do this?

Thanks

[niketn · Accepted solution]

@mbasharat Splunk Dashboard Examples App has an example for this particular scenario of passing Token from Source Dashboard to Destination as Form Token. Please download and try out the example.

Following is the kind of code you would need:

    <drilldown>
      <link target="_blank">/app/<yourSplunkAppName>/<yourDestinationDashboardName>?form.<yourTextBoxTokenNameInDestinationDashboard>=$row.SERVER$</link>
    </drilldown>

Following is a run anywhere example for source and destination dashboard based on Splunk's _internal index created under default search app (you would need to keep dashboard name as per the example to try them out)

Source Dashboard (source_dashboard_to_pass_component.xml)

<dashboard>
  <label>Source Dashboard To Pass Component</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| top 5 component showperc=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_blank">/app/search/destination_dashboard_to_use_component?form.tokComponent=$row.component$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Destination Dashboard (destination_dashboard_to_use_component.xml)

<form>
  <label>Destination Dashboard to Use Component</label>
  <fieldset submitButton="false">
    <input type="text" token="tokComponent" searchWhenChanged="true">
      <label>Filter Component</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO component="$tokComponent$"
| timechart count by component useother=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

[mbasharat]

Great. This is exactly what I needed. THANK YOU!!

[somesoni2]

This is a very basic Splunk simple xml drilldown use-case. See this for how to implement it

http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/DrilldownLinkToDashboard#Example_source_code