Dashboards & Visualizations

Is there a way to split a token after a user click generates the token?

ISP8055
Path Finder

Hi there, 

I have a dashboard with bar charts. 

The value of a bar chart would be in this format. e.g. "foo-10-bar". 

After an user clicks on the bar-chart, it leads to another dashboard with drilldown generating token with field values as $field$= "foo-10-bar" in this case. 

Is this possible to split the field value in three parts with - as a separator, when user clicks on the  bar chart. so in this case, it would be three tokens as $FieldA$= foo; $FieldB$=10; $FieldC$=bar?

Thanks. 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming foo-10-bar is the series name, try something like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.name2$,"-"),0)</eval>
  <eval token="FieldB">mvindex(split($click.name2$,"-"),1)</eval>
  <eval token="FieldC">mvindex(split($click.name2$,"-"),2)</eval>
</drilldown>

ISP8055
Path Finder

Hi there, 

currently, my drilldown looks like this:
<drilldown>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$click.value$</link>
</drilldown>

Will your eval statement work here?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try like this

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
</drilldown>
0 Karma

ISP8055
Path Finder

Hi there, I need 3 tokens to be linked to the other dashboard ( Field A, FieldB, FieldC). With your syntax above, we are getting FieldA only

 

 

<drilldown>
  <eval token="FieldA">mvindex(split($click.value$,"-"),0)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldA$</link>
  <eval token="FieldB">mvindex(split($click.value$," "),1)</eval>
  <link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldB$</link>
<eval token="FieldC">mvindex(split($click.value$," "),2)</eval>
<link target="_blank">/app/app_name/nameoflinked_dashboard?token_name=$FieldC$</link>
</drilldown>

 

 


I tried the above with FieldB and FIeldC tokens, but that doesn't work either. only FieldA is being linked.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you only get to link once

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...