Dashboards & Visualizations

Passing time parameters from drilldown on click to dashboard

eddychuah
Path Finder

I have 2 diff views/dashboards with respective time tokens in each. I've setup the drilldown onclick to "Link To Dashboard" and I'm looking to pass the source.time_token Earliest and Latest to the target destination time_token such that destination time_token default value of 60min is overridden and the destination page loads with the source time parameters

Notes:
- both respective time tokens (source and destination) are set as 60min defaults
- I would really like to use the Drilldown Editor GUI, so I would like to know what to enter into the Parameters section
- I've tried;

form.sourceTimeToken = form.destTimeToken
earliest = $earliest $
latest = $latest $

but the destination time token default of 60min over rides the above params in the query string

On the destination page, the input is setup as follows and i do not have any special instruction on what to do on page load;

<input type="time" searchWhenChanged="true" token="Time_Dest">
  <label>Some Time Picker</label>
  <default>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </default>
</input>

side complaint: I've read all the Splunk docs but there are very few examples on how to use the provided GUIs....only XML code edit examples

0 Karma
1 Solution

eddychuah
Path Finder

thanks @rjthibod and @niketnilay

figured out my own query (issue was between the keyboard and the chair lol), i was not setting the destination params with the proper token symbols $$

solution as follows;
on click - link to dashboard
App - select desired splunk app
Dashboard - select desired app dashboard

Parameters

form.destinationtimetokenname.earliest = $earliest$
form.destinationtimetokenname.latest= $latest$

View solution in original post

eddychuah
Path Finder

thanks @rjthibod and @niketnilay

figured out my own query (issue was between the keyboard and the chair lol), i was not setting the destination params with the proper token symbols $$

solution as follows;
on click - link to dashboard
App - select desired splunk app
Dashboard - select desired app dashboard

Parameters

form.destinationtimetokenname.earliest = $earliest$
form.destinationtimetokenname.latest= $latest$

markhill1
Path Finder

Hi, Are you able to post the final xml for the drilldown?
Thanks

0 Karma

niketn
Legend

@eddychuah, can you add more details on which visualization are you using for drilldown? Is it table or chart?
Also can you share the simple xml of the link you have created?

Have you looked at Splunk Dashboard Examples app which covers alot of drilldown examples?
https://splunkbase.splunk.com/app/1603/
And this is step by step for Drilldown using the UI (interactively) : http://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownIntro (however, UI Drilldown option is available from Splunk Enterprise 6.6 onward)

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rjthibod
Champion

Can't help you with dealing with the drilldown GUI (I hate it too).

Can you share the XML for the source panel? That would really help clarify how you are doing the drilldown.

0 Karma
Get Updates on the Splunk Community!

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...