Dashboards & Visualizations

Pass the value from one panel as token to another panel in dashboard

Deepz2612
Explorer

Hi,

I have panel in the dashboard with table as below.

Name SubName and SecondSearch

I would want to pass the value of SecondSearch as input to another panel in the same dashboard.

How should i set the token and pass it.

I used the below query :

<form>
  <label>try_hide_panle</label>
  <fieldset submitButton="false">
    <input type="time" token="field2">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="field1">
      <label>Response_Code</label>
      <choice value="400">400</choice>
      <choice value="404">404</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=* |table SecondSearch</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$field1$">
      <title>Stats By</title>
      <table>
        <title>Stats By</title>
        <search>
          <query>$SecondSearch$</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="response_code">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Vin">
          <colorPalette type="map">{"*":#6A5C9E}</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>

But it says It is waiting for input

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@Deepz2612 ,

That's because the SecondSearch token is not set

Try adding the done event after the first search to set the token

 <search>
   <query>| inputlookup trial.csv | where Name="vehicleimage-service-green" AND SubName="GET /api/vehicleimage/v1/vehicle/full" |table SecondSearch</query>
   <earliest>$field2.earliest$</earliest>
   <latest>$field2.latest$</latest>
   <sampleRatio>1</sampleRatio>
   <done>
      <set token="SecondSearch">$result.SecondSearch$</set>
   </done>
 </search>

View solution in original post

0 Karma

niketnilay
Legend

@Deepz2612 do you want to pass on specific value of SecondSearch from first panel as drilldown token when user clicks on the table? Or do you want to have second search run a query for all values of SecondSearch field in the first panel.

From your question seems like you want to create a drilldown i.e. only when User clicks a row of table in Panel 1 the value of Seacond search will be passed to second panel.

    <drilldown>
      <set token="SecondSearch">$row.SecondSearch$</set>
    </drilldown>

Following is a run anywhere example adapted from your current code as per the question.

<form>
  <label>Table Drilldown Token to Second Panel</label>
  <fieldset submitButton="false">
    <input type="time" token="field2">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="dd_field1">
      <label>Response_Code</label>
      <choice value="400">400</choice>
      <choice value="404">404</choice>
      <change>
        <set token="field1">true</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
           | eval SecondSearch="apple,banana,cherry,dates"
           | makemv SecondSearch delim=","
           | mvexpand SecondSearch
           | table SecondSearch</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="SecondSearch">$row.SecondSearch$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$field1$">
      <title>Stats By</title>
      <table>
        <title>Stats By</title>
        <search>
          <query>| makeresults
           | eval SecondSearch="apple,banana,cherry,dates"
           | makemv SecondSearch delim=","
           | mvexpand SecondSearch
           | search SecondSearch="$SecondSearch$"</query>
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
        </search>
        <option name="count">50</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="response_code">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Vin">
          <colorPalette type="map">{"*":#6A5C9E}</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@Deepz2612 ,

That's because the SecondSearch token is not set

Try adding the done event after the first search to set the token

 <search>
   <query>| inputlookup trial.csv | where Name="vehicleimage-service-green" AND SubName="GET /api/vehicleimage/v1/vehicle/full" |table SecondSearch</query>
   <earliest>$field2.earliest$</earliest>
   <latest>$field2.latest$</latest>
   <sampleRatio>1</sampleRatio>
   <done>
      <set token="SecondSearch">$result.SecondSearch$</set>
   </done>
 </search>

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.