Dashboards & Visualizations

Is there a way to split a token after a user click generates the token?

ISP8055
Path Finder

Hi there, 

I have a dashboard with bar charts. 

The value of a bar chart would be in this format. e.g. "foo-10-bar". 

After an user clicks on the bar-chart, it leads to another dashboard with drilldown generating token with field values as $field$= "foo-10-bar" in this case. 

Is this possible to split the field value in three parts with - as a separator, when user clicks on the  bar chart. so in this case, it would be three tokens as $FieldA$= foo; $FieldB$=10; $FieldC$=bar?

Thanks. 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming foo-10-bar is the series name, try something like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.name2$,"-"),0)</eval>
  <eval token="FieldB">mvindex(split($click.name2$,"-"),1)</eval>
  <eval token="FieldC">mvindex(split($click.name2$,"-"),2)</eval>
</drilldown>

ISP8055
Path Finder

Hi there, 

currently, my drilldown looks like this:
<drilldown>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$click.value$</link>
</drilldown>

Will your eval statement work here?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
</drilldown>
0 Karma

ISP8055
Path Finder

Hi there, I need 3 tokens to be linked to the other dashboard ( Field A, FieldB, FieldC). With your syntax above, we are getting FieldA only

 

 

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
  <eval token="FieldB">mvindex(split($click.value$," "),1)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldB$</link>
<eval token="FieldC">mvindex(split($click.value$," "),2)</eval>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldC$</link>
</drilldown>

 

 


I tried the above with FieldB and FIeldC tokens, but that doesn't work either. only FieldA is being linked.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you only get to link once

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...