- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Set a token value of a dashboard as the default of...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have 2 Dashboards A and B, They both have Dropdown Inputs for the host field and can be used individually. But Dashboard B is also mainly used as a Detail Drilldown for 1 search of Dashboard A. So what i want is when i click on the Drilldown in Dashboard A is that my Token value for the host field in Dasboard B is set to the token value of host of Dasboard A.
Thanks in advance for any help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can pass token values in the URL for the dashboard being called in the drilldown or another link e.g. html address element
Dashboard token setter
<form>
<label>Token setter</label>
<description>Inputs to set multi-select tokens</description>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="preselect" searchWhenChanged="true">
<label>Select</label>
<choice value="W">w</choice>
<choice value="X">x</choice>
<choice value="Y">y</choice>
<choice value="Z">z</choice>
<default>X</default>
<change>
<eval token="gettoken">"form.preselect=".mvjoin(split(preselect," "),"&form.preselect=")</eval>
</change>
</input>
<html>
<a target="_blank" href="/app/answers/token_getter?$gettoken|n$">Go to getter</a>
</html>
</fieldset>
</form>Dashboard token getter
<form>
<label>Token getter</label>
<description>Multi-select initialised on call</description>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="preselect" searchWhenChanged="true">
<label>Pre-select</label>
<choice value="W">w</choice>
<choice value="X">x</choice>
<choice value="Y">y</choice>
<choice value="Z">z</choice>
<default>X</default>
</input>
</fieldset>
</form>Note that the token name used in the url (gettoken) does not have to be the same as the multi-select token in the setting dashboard, but the value of the url argument(s) does need to match the token name in the getting dashboard. This should also use the convention form.token to set the value of the input in the getting dashboard.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can pass token values in the URL for the dashboard being called in the drilldown or another link e.g. html address element
Dashboard token setter
<form>
<label>Token setter</label>
<description>Inputs to set multi-select tokens</description>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="preselect" searchWhenChanged="true">
<label>Select</label>
<choice value="W">w</choice>
<choice value="X">x</choice>
<choice value="Y">y</choice>
<choice value="Z">z</choice>
<default>X</default>
<change>
<eval token="gettoken">"form.preselect=".mvjoin(split(preselect," "),"&form.preselect=")</eval>
</change>
</input>
<html>
<a target="_blank" href="/app/answers/token_getter?$gettoken|n$">Go to getter</a>
</html>
</fieldset>
</form>Dashboard token getter
<form>
<label>Token getter</label>
<description>Multi-select initialised on call</description>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="preselect" searchWhenChanged="true">
<label>Pre-select</label>
<choice value="W">w</choice>
<choice value="X">x</choice>
<choice value="Y">y</choice>
<choice value="Z">z</choice>
<default>X</default>
</input>
</fieldset>
</form>Note that the token name used in the url (gettoken) does not have to be the same as the multi-select token in the setting dashboard, but the value of the url argument(s) does need to match the token name in the getting dashboard. This should also use the convention form.token to set the value of the input in the getting dashboard.
Infographic provides the TL;DR for the 2024 Splunk Career Impact Report
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
