Dashboards & Visualizations

Problem with dynamic drilldown to dashboards

cvalenti
Explorer

Im trying to link one dashboard to another, using a token. But im not sure where to use the token as a reference in the search to the target dashboard.

My link is working fine I guess, the result that i click shows in the URL:

 <drilldown>
              <link target="_self">/app/search/pp_uol_resolve_drilldown?data_token=$click.value$</link>
    </drilldown>

Url: en-US/app/search/pp_uol_resolve_drilldown?data_token=2017-07-18

And the search for the destiny dashboard:

<query>index="uolresolve_venda_diaria" COD_INSCRIPTION_STATUS="I" 
| dedup IDT_INSCRIPTION ,COD_INSCRIPTION_STATUS sortby +_time 
| eval DATA_CANC=strftime(_time,"%Y-%m-%d %T")
| eval DATA_CRIACAO=strftime((strptime('DAT_INSCRIPTION',"%Y-%m-%d %T")),"%Y-%m-%d %T")
| eval QTDE_DIAS=round((strptime(DATA_CANC, "%F %T") - strptime(DATA_CRIACAO, "%F %T")) / 86400)
| eval data=strftime((strptime('DATA_CANC',"%Y-%m-%d")),"%Y-%m-%d")
| eval rel14=relative_time(now(),"-14d")
| eval data14=strftime(rel14,"%Y-%m-%d")
| table data,IDT_INSCRIPTION,QTDE_DIAS
| where data = $data_token$ 
| sort -QTDE_DIAS
</query>

But this doesn't works. Any help or tips?

0 Karma
1 Solution

rjthibod
Champion

You should use the CDATA tag in the source dashboard, and you should wrap the token with quotes in the drilldown. Try this for the drilldown.

<drilldown>
   <link target="_self">
     <![CDATA[/app/search/pp_uol_resolve_drilldown?data_token=$click.value$]]>
  </link>
</drilldown>

And then use this $data_token|s$ in the drilldown dashboard when you reference the token.

View solution in original post

rjthibod
Champion

You should use the CDATA tag in the source dashboard, and you should wrap the token with quotes in the drilldown. Try this for the drilldown.

<drilldown>
   <link target="_self">
     <![CDATA[/app/search/pp_uol_resolve_drilldown?data_token=$click.value$]]>
  </link>
</drilldown>

And then use this $data_token|s$ in the drilldown dashboard when you reference the token.

cvalenti
Explorer

Thanks @rjthibod. problem solved.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...