Dashboards & Visualizations

Need help with tokenization on timechart for Dashboard Studio v9.3.2

ripvw32
Explorer

Have this query I am using for a visualization: 

<My query strings>

| eval ApiName=upper(ApiName)

| stats earliest(_time) AS StartTime latest(_time) AS EndTime BY correlationId ApiName
| eval DurationInSecs = EndTime - StartTime
| where DurationInSecs >= 0
| eval StartTimeR = StartTime + 30
| bin StartTimeR span=1m
| eval Time = StartTimeR - 30

| eval _time = Time
| timechart span=15m limit=0 useother=f $DurationToken$(DurationInSecs) BY ApiName


I've added an interaction so that when someone clicks on a line or on the legend, it will open a new tab to the desired dashboard (works) and pass the token in to be used in a new query in a new visual in the newly opened dashboard (not working)

Here is the interaction source code:

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "row.ApiName.value"
                    }
                ]
            }
        }
    ],
...}
 


However, when I click on the line/legend name for a specific ApiName I get the new dashboard tab opened, but the sent value is the text string 'row.ApiName.value' vs. the ApiName I clicked on/am expecting.

I check to see what the token is carrying via a markdown text box I have on the new dashboard using $ApiNameToken$ in the text box. 

I have zero issues with doing it this way when using anything other than a time chart.

Please help me understand what am I doing incorrectly?

Labels (4)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @ripvw32 

When you do your timechart by apiName you no longer have a column/field called 'apiName' - instead you have column for each apiName in your original search (e.g. API1)

Therefore you cannot use row.apiName.value in your drilldown - instead you can use 'name' which is the name of the field clicked - which should be the apiName value.

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "name"
                    }
                ]
            }
        }
    ],
...}

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

ripvw32
Explorer

@livehybrid This is the second time you've really helped me out. Thank you so much!

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @ripvw32 

When you do your timechart by apiName you no longer have a column/field called 'apiName' - instead you have column for each apiName in your original search (e.g. API1)

Therefore you cannot use row.apiName.value in your drilldown - instead you can use 'name' which is the name of the field clicked - which should be the apiName value.

{...
    "eventHandlers": [
        {
            "type": "drilldown.linkToDashboard",
            "options": {
                "app": "mygroupname_search",
                "dashboard": "my_api_stats__api_drill_down",
                "newTab": true,
                "tokens": [
                    {
                        "token": "ApiNameToken",
                        "value": "name"
                    }
                ]
            }
        }
    ],
...}

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...