Dashboards & Visualizations

Is there a way to split a token after a user click generates the token?

ISP8055
Path Finder

Hi there, 

I have a dashboard with bar charts. 

The value of a bar chart would be in this format. e.g. "foo-10-bar". 

After an user clicks on the bar-chart, it leads to another dashboard with drilldown generating token with field values as $field$= "foo-10-bar" in this case. 

Is this possible to split the field value in three parts with - as a separator, when user clicks on the  bar chart. so in this case, it would be three tokens as $FieldA$= foo; $FieldB$=10; $FieldC$=bar?

Thanks. 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming foo-10-bar is the series name, try something like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.name2$,"-"),0)</eval>
  <eval token="FieldB">mvindex(split($click.name2$,"-"),1)</eval>
  <eval token="FieldC">mvindex(split($click.name2$,"-"),2)</eval>
</drilldown>

ISP8055
Path Finder

Hi there, 

currently, my drilldown looks like this:
<drilldown>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$click.value$</link>
</drilldown>

Will your eval statement work here?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
</drilldown>
0 Karma

ISP8055
Path Finder

Hi there, I need 3 tokens to be linked to the other dashboard ( Field A, FieldB, FieldC). With your syntax above, we are getting FieldA only

 

 

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
  <eval token="FieldB">mvindex(split($click.value$," "),1)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldB$</link>
<eval token="FieldC">mvindex(split($click.value$," "),2)</eval>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldC$</link>
</drilldown>

 

 


I tried the above with FieldB and FIeldC tokens, but that doesn't work either. only FieldA is being linked.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you only get to link once

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...