Dashboards & Visualizations

Set and use tokens from a (hidden) panel without clicking on it.

johnmvang
Path Finder

Hello,

I have 3 panels on a single dashboard.

The first panel is visible where it TABLEs out a list of events which you can click on.
The second panel is hidden and is waiting on the value you click on from the first panel and runs a search and displays more events in a TABLE.
The third panel is also hidden and populated by the first and second panels then writes to a kvstore

Problem I'm having is passing the tokens from the second panel to the third panel. Example below:

My snippet of the second panel from XML

       <search>

          <query>
          my search <token from panel1>... | table field1 field2
          </query>

          <earliest>-15m</earliest>
          <latest>now</latest>

          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="set_field1_tok">$row.field1$</set>
              <set token="set_field2_tok">$row.field2$</set>
              <set token="fix_earliest">-15m</set>
              <set token="fix_latest">now</set>
            </condition>
          </progress>

        </search>

    <option name="count">10</option>
    <option name="drilldown">cell</option>

when I call $set_field1_tok$ and/or $set_field2_tok$ in panel3 I literally get the values "$row.field1$" and "$row.field2$" and not the expected field value. Am I doing this right? Or is this wrong?

Thanks.

0 Karma
1 Solution

johnmvang
Path Finder
0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi
Use the <done> handler instead of the <progress>. Also you need to use $row.< field_name >$.

More information about the tokens: http://docs.splunk.com/Documentation/Splunk/7.1.1/Viz/PanelreferenceforSimplifiedXML#Predefined_dril...

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

johnmvang
Path Finder

hello, i did change my 'progress' flags to 'done'. Also my code shows i am already using $row.field_value$.

From what i'm reading, it sounds like it has to be a drilldown/CLICKED value. it can't just be set from a search finishing and pulling the fields from the finished search.

The way i have it set, it just sets the token as the literal words "$row.field_name$" and not expected field values.

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...