Dashboards & Visualizations

Is there a way to split a token after a user click generates the token?

ISP8055
Path Finder

Hi there, 

I have a dashboard with bar charts. 

The value of a bar chart would be in this format. e.g. "foo-10-bar". 

After an user clicks on the bar-chart, it leads to another dashboard with drilldown generating token with field values as $field$= "foo-10-bar" in this case. 

Is this possible to split the field value in three parts with - as a separator, when user clicks on the  bar chart. so in this case, it would be three tokens as $FieldA$= foo; $FieldB$=10; $FieldC$=bar?

Thanks. 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming foo-10-bar is the series name, try something like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.name2$,"-"),0)</eval>
  <eval token="FieldB">mvindex(split($click.name2$,"-"),1)</eval>
  <eval token="FieldC">mvindex(split($click.name2$,"-"),2)</eval>
</drilldown>

ISP8055
Path Finder

Hi there, 

currently, my drilldown looks like this:
<drilldown>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$click.value$</link>
</drilldown>

Will your eval statement work here?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
</drilldown>
0 Karma

ISP8055
Path Finder

Hi there, I need 3 tokens to be linked to the other dashboard ( Field A, FieldB, FieldC). With your syntax above, we are getting FieldA only

 

 

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
  <eval token="FieldB">mvindex(split($click.value$," "),1)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldB$</link>
<eval token="FieldC">mvindex(split($click.value$," "),2)</eval>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldC$</link>
</drilldown>

 

 


I tried the above with FieldB and FIeldC tokens, but that doesn't work either. only FieldA is being linked.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you only get to link once

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...