Dashboards & Visualizations

Is there a way to split a token after a user click generates the token?

ISP8055
Path Finder

Hi there, 

I have a dashboard with bar charts. 

The value of a bar chart would be in this format. e.g. "foo-10-bar". 

After an user clicks on the bar-chart, it leads to another dashboard with drilldown generating token with field values as $field$= "foo-10-bar" in this case. 

Is this possible to split the field value in three parts with - as a separator, when user clicks on the  bar chart. so in this case, it would be three tokens as $FieldA$= foo; $FieldB$=10; $FieldC$=bar?

Thanks. 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming foo-10-bar is the series name, try something like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.name2$,"-"),0)</eval>
  <eval token="FieldB">mvindex(split($click.name2$,"-"),1)</eval>
  <eval token="FieldC">mvindex(split($click.name2$,"-"),2)</eval>
</drilldown>

ISP8055
Path Finder

Hi there, 

currently, my drilldown looks like this:
<drilldown>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$click.value$</link>
</drilldown>

Will your eval statement work here?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
</drilldown>
0 Karma

ISP8055
Path Finder

Hi there, I need 3 tokens to be linked to the other dashboard ( Field A, FieldB, FieldC). With your syntax above, we are getting FieldA only

 

 

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
  <eval token="FieldB">mvindex(split($click.value$," "),1)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldB$</link>
<eval token="FieldC">mvindex(split($click.value$," "),2)</eval>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldC$</link>
</drilldown>

 

 


I tried the above with FieldB and FIeldC tokens, but that doesn't work either. only FieldA is being linked.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you only get to link once

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...