Dashboards & Visualizations

Pass the value from one panel as token to another panel in dashboard

Deepz2612
Explorer

Hi,

I have panel in the dashboard with table as below.

Name SubName and SecondSearch

I would want to pass the value of SecondSearch as input to another panel in the same dashboard.

How should i set the token and pass it.

I used the below query :

<form>
  <label>try_hide_panle</label>
  <fieldset submitButton="false">
    <input type="time" token="field2">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="field1">
      <label>Response_Code</label>
      <choice value="400">400</choice>
      <choice value="404">404</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=* |table SecondSearch</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$field1$">
      <title>Stats By</title>
      <table>
        <title>Stats By</title>
        <search>
          <query>$SecondSearch$</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="response_code">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Vin">
          <colorPalette type="map">{"*":#6A5C9E}</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>

But it says It is waiting for input

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@Deepz2612 ,

That's because the SecondSearch token is not set

Try adding the done event after the first search to set the token

 <search>
   <query>| inputlookup trial.csv | where Name="vehicleimage-service-green" AND SubName="GET /api/vehicleimage/v1/vehicle/full" |table SecondSearch</query>
   <earliest>$field2.earliest$</earliest>
   <latest>$field2.latest$</latest>
   <sampleRatio>1</sampleRatio>
   <done>
      <set token="SecondSearch">$result.SecondSearch$</set>
   </done>
 </search>
Happy Splunking!

View solution in original post

0 Karma

niketn
Legend

@Deepz2612 do you want to pass on specific value of SecondSearch from first panel as drilldown token when user clicks on the table? Or do you want to have second search run a query for all values of SecondSearch field in the first panel.

From your question seems like you want to create a drilldown i.e. only when User clicks a row of table in Panel 1 the value of Seacond search will be passed to second panel.

    <drilldown>
      <set token="SecondSearch">$row.SecondSearch$</set>
    </drilldown>

Following is a run anywhere example adapted from your current code as per the question.

<form>
  <label>Table Drilldown Token to Second Panel</label>
  <fieldset submitButton="false">
    <input type="time" token="field2">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="dd_field1">
      <label>Response_Code</label>
      <choice value="400">400</choice>
      <choice value="404">404</choice>
      <change>
        <set token="field1">true</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
           | eval SecondSearch="apple,banana,cherry,dates"
           | makemv SecondSearch delim=","
           | mvexpand SecondSearch
           | table SecondSearch</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="SecondSearch">$row.SecondSearch$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$field1$">
      <title>Stats By</title>
      <table>
        <title>Stats By</title>
        <search>
          <query>| makeresults
           | eval SecondSearch="apple,banana,cherry,dates"
           | makemv SecondSearch delim=","
           | mvexpand SecondSearch
           | search SecondSearch="$SecondSearch$"</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="response_code">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Vin">
          <colorPalette type="map">{"*":#6A5C9E}</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@Deepz2612 ,

That's because the SecondSearch token is not set

Try adding the done event after the first search to set the token

 <search>
   <query>| inputlookup trial.csv | where Name="vehicleimage-service-green" AND SubName="GET /api/vehicleimage/v1/vehicle/full" |table SecondSearch</query>
   <earliest>$field2.earliest$</earliest>
   <latest>$field2.latest$</latest>
   <sampleRatio>1</sampleRatio>
   <done>
      <set token="SecondSearch">$result.SecondSearch$</set>
   </done>
 </search>
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...