Dashboards & Visualizations

How to use a token set as an previous input value as condition for a link in drilldown

erwanlebaron
Engager

Hi

After looking on the forum, I don't find a solution to solve my issue.
I use drilldown on a table to open a link on another application.

<drilldown>
   <link target="_blank">https://cmp.<blablabla>/$row.Id$/overview</link>
</drilldown>

But the link will change depanding of a token set trough an input

  <fieldset submitButton="false">
    <input type="dropdown" token="env_portal">
      <label>Environment</label>
      <choice value="prd">PRD</choice>
      <choice value="tvp">TVP</choice>
      <initialValue>prd</initialValue>
    </input>
  </fieldset>

I tried to add a condition in the drilldown but it doesn't work

<drilldown>
     <condition match=" $env_portal$ == 'prd' ">
            <link target="_blank">https://cmp.<blablabla>/$row.Id$/overview</link>
     </condition>
     <condition match=" $env_portal$ == 'tvp' ">
            <link target="_blank">https://cmp-tvp.<blablabla>/$row.Id$/overview</link>
     </condition>
</drilldown>

How I can do a seach condition ?

Regards

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this sample

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval websitename="google,yahoo" 
| makemv delim="," websitename 
| mvexpand websitename</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="$row.websitename$ == &quot;google&quot; ">
            <link target="_blank">
              <![CDATA[ http://www.google.com ]]>
            </link>
          </condition>
          <condition match="$row.websitename$ == &quot;yahoo&quot; ">
            <link target="_blank">
              <![CDATA[ http://www.yahoo.com ]]>
            </link>
          </condition>
          <condition></condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this sample

<dashboard>
  <label>drilldown</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| eval websitename="google,yahoo" 
| makemv delim="," websitename 
| mvexpand websitename</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <condition match="$row.websitename$ == &quot;google&quot; ">
            <link target="_blank">
              <![CDATA[ http://www.google.com ]]>
            </link>
          </condition>
          <condition match="$row.websitename$ == &quot;yahoo&quot; ">
            <link target="_blank">
              <![CDATA[ http://www.yahoo.com ]]>
            </link>
          </condition>
          <condition></condition>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

erwanlebaron
Engager

Perfect it works with " for a quote in the "match" !

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...